JOURNAL OF LATEX CLASS FILES, VOL. 18, NO.

9, SEPTEMBER 2022 1

A Survey on Physical Adversarial Attack in

Computer Vision
Donghua Wang1,2 , Wen Yao2∗ , Tingsong Jiang2∗ , Guijian Tang2,3 , Xiaoqian Chen2
1College of Computer Science and Technology, Zhejiang University, Hangzhou, China
2 Defense Innovation Institute, Chinese Academy of Military Science, Beijing, China
3 College of Aerospace Science and Engineering, National University of Defense Technology, Changsha, China
wangdonghua@zju.edu.cn, wendy0782@126.com, tingsong@pku.edu.cn, tangbanllniu@163.com,
chenxiaoqian@nudt.edu.cn
arXiv:2209.14262v2 [cs.CV] 4 Jan 2023

Abstract—In the past decade, deep learning has dramatically

changed the traditional hand-craft feature manner with strong
feature learning capability, promoting the tremendous improve-
ment of conventional tasks. However, deep neural networks
(DNNs) have been demonstrated to be vulnerable to adversarial
examples crafted by small noise, which is imperceptible to human
observers but can make DNNs misbehave. Existing adversarial
attacks can be divided into digital and physical adversarial
attacks. The former is designed to pursue strong attack per-
formance in lab environments while hardly remaining effective
when applied to the physical world. In contrast, the latter focus on
developing physical deployable attacks, which are more robust
in complex physical environmental conditions (e.g., brightness,
occlusion, etc.). Recently, with the increasing deployment of the
DNN-based system in the real world, enhancing the robustness
of these systems is an emergency, while exploring physical
adversarial attacks exhaustly is the precondition. To this end, this Fig. 1. Count of physical attack literature published yearly.
paper reviews the development of physical adversarial attacks
against DNN-based computer vision tasks (i.e., image recogni-
tion and object detection tasks), which can provide beneficial elaborately designed glasses frames can bypass the facial
information for developing stronger physical adversarial attacks. recognition system; the automatic driving car is susceptible to
For completeness, we will briefly introduce the works that do
not involve physical attacks but are closely related to them. environmental changes (e.g., shadow or brightness), resulting
Specifically, we first proposed a taxonomy to summarize the in out-of-control or misdetection. That poses a potential risk
current physical adversarial attacks. Then we briefly discuss for deploying DNN-based systems in the real world, especially
the existing physical attacks and focus on the technique for for security-sensitive applications.
improving the robustness of physical attacks under complex Since Szegedy et al. [9] first found that the DNN-based
physical environmental conditions. Finally, we discuss the issues
of the current physical adversarial attacks to be solved and give image classifier is susceptible to malicious devised noise, a
promising directions. line of works [10]–[16] have been proposed to explore the
adversarial examples and the corresponding countermeasure
Index Terms—Adversarial examples, Physical adversarial at-
tacks, Security of neural network techniques in different research areas, especially in computer
vision. Accordingly, many surveys [17]–[22] were proposed to
the taxonomy or summarize the development of the adversarial
I. I NTRODUCTION examples. Serban et al. [21] made taxonomy exhaustively for
attack and systemically summarized the existing attack meth-
D EEP neural networks (DNNs) achieves considerable
success in a wide range of research filed, including
computer vision [1]–[4], natural language processing [5], [6],
ods from machine learning to DNNs. [20], [22]–[25] reviewed
the development of adversarial attack and defense methods
and speech recognition [7], [8]. Applications with the core against DNNs at different times. Some survey only focus on
of these advanced techniques have been widely deployed the specific task, such as image classification [26], adversarial
in the real world, such as facial payment, medical image patch [27]. However, these surveys mainly provide an overall
diagnosis, automatic driving, and so on. However, DNNs have view of the adversarial attack and defense in the specific
exposed their security risks to adversarial examples crafted research area or a roughly overall view. Moreover, with the
by small noises that are invisible to humane observers but increasingly maturing of DNNs in commercial deployment,
can mislead the DNNs to output wrong results. For instance, exploring the physical attack is more urgent for enhancing
the robustness of DNN-based systems. Although some works
*Wen Yao and Tingsong Jiang are the corresponding authors. have reviewed the development of physical attacks [22], [28],
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
they are out-of-date since plenty of novel physical attacks
have emerged [29]–[39] in the past two years. Concurrent
to our work, although [40], [41] review physical attacks,
they only review some of the current physical attacks, i.e.,
43 and 46 publications, respectively. In contrast, we review
69 publications on physical attacks. Figure 1 illustrates the
number of physical attack literature published yearly since
2016. Therefore, it is necessary to analyze the newly proposed
method for better tracking the latest research direction.
In this paper, we comprehensively review the existing
physical adversarial attacks in the computer vision task. Given
the statistical result of the current literature, we mainly survey
the two most prevalent tasks: image recognition and object
detection. Note that, object tracking and semantic segmenta-
tion tasks are similar to object detection. Thus we include
the physical adversarial attack against object tracking and
semantic segmentation in object detection. Specifically, we
first propose a taxonomy to summarize the current physical
adversarial attacks from the formal of adversarial perturbation,
the way of physical attack, the settings of physical attack, and
so on. Then, we briefly analyze different physical adversarial
attacks in detail. After reviewing attacks for each field, we
summarize the most frequently used technique for improving
the robustness of physical attacks. Finally, we discuss the
issues of the current physical adversarial attacks to be solved
and the promising direction. We hope this survey will pro-
vide comprehensive retrospect and beneficial information on
physical adversarial attacks for researchers.
To cover the existing physical attacks as much as possible,
we searched the keywords “physical attack” or “physical
adversarial examples” from Google Scholar to obtain the
latest paper. In addition, conference proceedings in CVPR,
ICCV, ECCV, AAAI, IJCAI, ICML, ICLR, and NeurIPS were
searched based on the keyword toward titles of the papers. We
manually checked the references in all selected papers to seek
the relevant literature to avoid leakage. In addition, we exclude
papers that have not relevant to physical adversarial attacks.
Finally, we collected 69 physical adversarial attack papers in
computer vision.
In summary, our contributions are listed as follows.
• We make a comprehensive survey on physical adversar-
ial attacks in computer vision tasks to provide overall
knowledge about this research field.
• We propose a taxonomy to summarize the existing phys-
ical adversarial attacks according to the characteristic of
different attacks. We briefly discuss different physical
attacks and outline the most frequently used techniques
for improving the robustness of physical attacks.
• We discuss the challenging and research directions for
physical adversarial attacks based on the following is-
sues: input transformation augmentation; attack algorithm
design consisting of developing physical attacks under
black-box settings, transferability, attack multitask, and
so on; evaluation contains physically attack benchmark
evaluation datasets construction and uniform physical test
criterion.
2
TERMINOLOGY
x Clean image.
y Ground truth of the image.
x̂ Clean image in the physical world.
xadv Adversarial example.
x̂adv Adversarial example in the physical world.
δ Adversarial perturbation.
 Maximum allowable magnitude of perturbation.
f Neural network.
ycls Ground truth label for the classification task.
yobj Ground truth label for the object detection task.
Jf (·) Loss function for neural network f.
∇Jf (·) The gradient of the f with respect to the input x.
|| · ||p Lp norm distance.
d(·, ·) Distance metrics.
T Transformation distribution.
t A specific transformation.
II. F UNDAMENTAL CONCEPT
In this section, we briefly introduce the foundation concept
of deep learning and adversarial examples.
A. Deep learning
Deep learning, a data-driven technique, is known for its
powerful capability to understand data patterns and features
from enormous data, where the learned representations are
beneficial to various regressions or classification tasks. In gen-
eral, the deep learning technique consists of data preprocess-
ing, architecture design, training strategy, loss function, and
performance metrics. The core component of deep learning
is automatic feature learning driven by deep neural networks
(DNNs), in which the most representative characteristic is that
it can extract useful features from considerable data in an end-
to-end manner.
The architecture of DNN is determined by the different
connections and numbers between the neurons and the layers.
In the past decade, convolutional neural networks (CNNs)
were the most commonly used architecture in computer vision
tasks and have been maturely deployed in commercial appli-
cations. CNN consists of multiple hidden layers with different
connections, where each layer contains several convolution
kernels for extracting different feature representations from
input data. The representative architecture of CNN in computer
vision is ResNet [2], VGG [42], and DenseNet [43], which
are employed in image recognition tasks and object detection
tasks [2], [44]. Recently, inspired by the incredible success
of transformer architecture in the NLP task, the transformer
has gradually been applied to computer vision tasks, called
vision transformers. Vision transformer consists of an encoder
and decoder with several transformer blocks of the same ar-
chitecture. The encoder produces the embedding of the inputs,
while the decoder takes all embedding as input to generate the
output with their incorporated contextual information. Despite
the architecture discrepancy between different networks, the
neural network has a uniform representation formal, i.e., f (x),
and the concrete representation of f (x) depends on the given
tasks. However, despite DNNs achieving great success, the
underlying mechanism of DNNs is unclear and exposing the
potential security risks as it is overly dependent on the data.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
B. Adversarial examples
The concept of the adversarial examples was first proposed
by Szegedy et al. [9], which refers to a kind of sample
containing carefully crafted noise that is invisible to human
observers but can mislead the DNN to make the wrong output.
Specifically, given an image x and a well-trained network f ,
the adversarial examples can be represented as the following
optimization problem
min δ
s.t.f (x + δ) 6= f (x) (1)
||δ||p ≤ ,
where the || · ||p is the Lp -norm,  is the maximum magnitude
of the δ under the constrain of Lp -norm. L0 , L2 and L∞ are
the three commonly used Lp metrics. L0 counts the number
of the non-zero pixels in the adversarial perturbation δ, L2
measures the Euclidean distance between the δ and zero, and
L∞ measures the maximum value of δ.
Adversarial examples can be used to perform attacks on the
digital world and the physical world. In digital world attacks,
the adversary aims to explore corner cases that can fool the
DNNs, where the optimization and evaluation settings are ideal
and remain unchanged. By contrast, in physical world attacks,
there is a huge gap between the optimization and evaluation of
adversarial examples. The adversarial perturbation is usually
generated in the digital world in advance and then required to
be made out (e.g., printed out) at the attack stage. Therefore,
the adversarial perturbation might encounter the following
loss at the attack stage: on the first hand, loss caused by
the device noise and color discrepancy between digital and
physical caused by the printer. On the other hand, content
distortion originated in complex environmental conditions,
such as lighting, shadow, occlusion, brightness changing, ro-
tation, deformation, and so on. Note that, despite some works
attempting to attack the online employed DNN-based systems,
we do not discuss these works as we are focused on the
attacks that can apply to the real world. Based on the above
discussion, developing effective physical adversarial attacks
are more challenging than digital attacks.
III. TAXONOMY OF PHYSICAL ADVERSARIAL EXAMPLES
In this section, we propose a taxonomy scheme to sys-
tematically categorize the existing physical adversarial attack
methods in computer vision tasks. Specifically, we first intro-
duce the basic classification of adversarial examples. Then, we
divide all physical adversarial attack methods in the computer
vision tasks into image classification and object detection
according to the tasks of victim models. We then categorize
the existing physical attack methods in terms of the form
of perturbation, the way of attacks, representative techniques
for improving the robustness of physical attacks, and testing
environments according to the implementation details of dif-
ferent attack methods. Finally, we describe three widely used
techniques for improving physical attack strengths.
3
A. Adversary’s knowledge
1) White-box attacks: White-box attacks assume the ad-
versary has full knowledge about the target victim network,
including architecture, parameters, and training data. In white-
box settings, the adversary is permitted to exploit the gradient
with respect to input images of the target victim model
to construct the adversarial examples. Therefore, white-box
attacks are the most efficient adversarial attacks at present.
2) Black-box attacks: Black-box attacks assume the adver-
sary has no knowledge about the target victim network but
allows the adversarial to query the target model, which makes
it more suitable in practice. Therefore, black-box attacks are
more challenging than white-box attacks. Nonetheless, there
are some algorithms to perform black-box attacks, such as
genetic algorithm, evolution evolution algorithm, and differ-
ential algorithm, or exploit the transferability of adversarial
examples.
B. Adversarial specificity
1) Non-targeted attack: Non-targeted attacks mislead the
target victim model to output any class except the original.
Intuitively, non-target attacks tend to search the adversarial
example along the direction of the nearest decision boundary
to the original sample.
2) Targeted attacks: Targeted attacks refer to misleading
the target victim model to output a pre-specific class. Although
object detection has multiple outputs (i.e., bounding boxes,
classes, and the confidence score of the detected object), it
can be uniformly represented as the class in targeted attacks
for consistency with classification tasks. Targeted attacks are
hard to realize when the distance between the original class
and the target class in the high-dimensional decision boundary
is far. Therefore, targeted attacks are more challenging than
non-targeted.
C. Computer vision tasks
1) Image recognition task: Image recognition is a conven-
tional task in computer vision designed to classify the input
image into a specific class. For a well-trained DNN-based
image classifier f , given an image x, one can get the output
f (x) = ycls , where ycls = y, ycls and y is the predicted class
and ground truth of the input image, respectively, which are
usually denoted as a scalar.
2) Object detection task: Object detection is another tradi-
tional task in computer vision, designed to locate the object
in the image and simultaneously give the class of the located
object. For a well-trained DNN-based object detector f , given
an image x, one can get the output f (x) = yobj , where yobj
contain three outputs including the bounding box, the confi-
dence score, and category, where the bounding box contains
two coordinates consists of four scalars, latter two terms are
scalar value.
D. Form of perturbation
Unlike the attack designed to add perturbation to the whole
image, physical adversarial attacks are devised to modify the
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022 4

object region to mislead the target model, called instance-level TABLE I

attacks. The reason is that it is impossible to modify the back- T RANSFORMATION DISTRIBUTION REPORTED IN [45]–[48].
ground environment (e.g., sky) in the real world. In contrast, Transform Parameters Remark
instance-level attacks concentrate on crafting the perturbation Affine µ = 0, σ = 0.1 Perspective/Deformed Transforms
for the targeted object. Therefore, instance-level attacks are Rotation −15◦ ∼ 15◦ Camera Simulation
Contrast 0.5 ∼ 1.5 Camera Parameters
suitable for performing physical attacks. According to the Scale 0.25 ∼ 1.25 Distance/Resize
form used to modify the target object, the perturbation can be Brightness −0.25 ∼ 0.25 Illumination
categorized as the adversarial patch, adversarial camouflage Translation −0.04 ∼ 0.04 Pattern Location
Cropping −0.7 ∼ 1.0 Photograph/Occlude Simulation
texture, and optical attacks. Random Noise −0.15 ∼ 0.15 Noise
1) Adversarial patch: The adversarial patch is an image
patch that can be stuck on the target object’s surface. Thus, ad-
versarial patch attacks have the advantage of easily performing
physical attacks as the adversary only requires printing out the
patch and then sticking/hanging it on the specific target object.
In optimization, the adversarial patch is pasted on the target
(a) Digital Image
object, which is consistent with physical deployable. However,
inconsistencies exist when the target object is not a plane, as
it simply pastes on the plane target in the 2D image during
optimization. Additionally, the adversarial patch merely works
in the specific view. The above issues curb the usefulness of
(b) Printed Image
adversarial patches in the real world.
2) Adversarial camouflage texture: Adversarial camouflage Fig. 2. Visualization discrepancy between the digital image (a) and its printed
images (b). [50]
texture attacks are designed to modify the appearance of the
3D object by the optimized adversarial texture, which can be
wrapped/painted over the target object’s surface, such as the contrast, the adversary implements non-invasion attacks by
pattern of clothes or the scrawl/painting of the vehicle. Thus, projecting a shadow or emitting a laser toward the target
that perturbation is suitable for non-plane objects, making it object, which is more stealthy and dangerous. Optical attacks
remain consistent well with the deployment in physical attacks. fall into this type.
There are two technology roadmaps to optimize the texture.
One is to optimize a 2D image as the texture of the target
object; The other is to optimize a 3D texture directly with the F. Techniques for enhancing the robustness of physical attacks
help of a physical renderer. 1) Expectation Over Transformation (EOT): EOT is a gen-
3) Optical attacks: Unlike adversarial patch or camouflage eral framework for improving the adversarial robustness of
texture attacks, optical attacks are designed to modulate the physical attack on a given transformation distribution T [49].
light or laser to perform physical attacks. In physical attacks, Essentially, EOT is a data augmentation technique for adver-
the adversary emits the light/laser by the lighting device (e.g., sarial attacks, which takes potential transformation in the real
projector and laser emitter) toward the target object to modify world into account during the optimization, resulting in better
its appearance for attacking the target model. Thus, optical robustness. Table I provides the widely used transformations
attacks are controllable and well stealthy. However, optical reported in [45]–[48]. Specifically, rather than taking the norm
0
attacks are susceptible to environmental light, which curbs of x − x to constrain the solution space, given a distance
their utilization in practice. function d(·, ·), EOT instead aims to constrain the expected
effective distance between the adversarial and original inputs
under a transformation distribution, which expressed as
E. Way of physical adversarial attack
0
According to whether the target object requires to be δ = Et∼T [d(t(x ), t(x))]. (2)
modified, the implementation way of physical attacks can be
categorized into invasion attacks and non-invasion attacks. Note that, this survey categorizes the methods that used the
1) Invasion attacks: Invasion attacks mean that the adver- transformation as EOT for simplicity.
sarial perturbation would modify the object itself. For instance, 2) Non-Printability Score (NPS): One necessary way to
in attack facial recognition, the adversary wears an adversarial perform physical attacks is to print the adversarial perturba-
hat and glasses; In attack pedestrian detection, the adversary tion. Thus, the perturbation will inevitably have some distor-
wears clothes or holds an adversarial patch plane; In attack tion caused by the printer, resulting in attacks failing in some
vehicle detection, the adversary modifies the appearance of cases. For instance, Figure 2 illustrates the digital color and
the vehicle by pasting the adversarial patch or painting the its printed result. To address this issue, non-printability score
adversarial camouflage over the surface of the object to be (NPS) loss [51] is devised as a metric to measure the color
attacked. distance between optimized adversarial perturbation and the
2) Non-invasion attacks: Non-invasion attacks do not re- common printer. In general, the NPS loss can be represented
quire the adversary to modify the target object manually. In as the following loss
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
Lnps =
X
min |p(i,j) − cprint |,
p(i,j) ∈xadv
cprint ∈C
where the p(i,j) is a pixel at coordinate (i, j) in the adversarial
example and cprint is a color in a set of printable colors C.
Under the constraints of NPS loss, the optimized adversarial
perturbation will gradually close to the predefined printable
colors.
3) Total variation norm (TV loss) : Natural images have
representative characteristics of smooth and consistent patches,
where color is only gradually within patches [52]. Hence,
finding smooth and consistent perturbations enhances the
plausibility of physical attacks. In addition, due to sampling
noise, extreme differences between adjacent pixels in the
perturbation are unlikely to be accurately captured by cameras.
Consequently, perturbations that are non-smooth may not
be physically realizable [51]. To address the above issues,
total variation (TV) [52] loss is presented to maintain the
smoothness of perturbation. For a perturbation δ, TV loss is
defined as
1
X
T V (δ) = ((δi,j − δi+1,j )2 + (δi,j − δi,j+1 )2 ) 2 ,
i,j
where δi,j is a pixel in δ at coordinates (i, j). T V (δ) is
low when the values of adjacent pixels are close to each
other (i.e., the perturbation is smooth) and vice versa [51].
Therefore, under the constraint of T V (δ) loss, the perturbation
is gradually smooth and suitable for physical realizability.
4) Digital-to-Physical (D2P): In some cases, EOT cannot
cover all physical world transformations, such as the discrep-
ancy between the digital image and the corresponding captured
physical image caused by environmental factors. Thus, some
researchers [53] proposed to utilize the digital image and
the corresponding physical image pair (namely, D2P) to train
the adversarial perturbation, reducing such discrepancy. D2P
has been shown the effectiveness in improving the physical
robustness of adversarial perturbation. Therefore, D2P can
be regarded as an effective technique to boost the physical
robustness of adversarial attacks.
G. Physical Testing environment
The common process of physical adversarial attacks is de-
scribed as follows: first, optimize the adversarial perturbation
in the digital world. Then, prepare the adversarial perturbation
and paste/paint it over the target object, e.g., printing out the
adversarial patch with the color printer and then hanging it
on the object. Finally, place the adversarial perturbed object
toward the deployed sensor device (e.g., RGB camera sensor)
to perform attacks. Figure 3 provides an overview of the
whole process of physical attacks. According to the relation
between the adversarial object and the sensor device, the
physical testing environment can be divided into stationary
and dynamic.
5
1) Stationary physical test: The stationary physical ad-
(3) versarial test experiment is performed in a static physical
environment, which means the adversary object and the sensor
device maintain the static at the same time. For example, to
attack the automatic checkout system, the adversarial sticks the
adversarial patch to the surface of the commodity and place
it under the sensor input of checkout systems [29], [54].
2) Dynamic physical test: The dynamic physical test is
performed in a dynamic environment, which makes it more
challenging. The reason is that more factors will impact
perturbation as the changing environment. Thus, the dynamic
physical test includes three different formals 1) the adversarial
object is fixed while the sensor device is moving (e.g., drone
surveillance); 2) the adversarial object moving while the sensor
device is fixed (e.g., video surveillance); 3) both the adversarial
object and the sensor device are moving simultaneously (e.g.,
automatic driving).
According to devised taxonomy scheme, we summarize the
existing physical adversarial examples of image recognition
and object detection task in Table II and Table III separately,
and we provide the follow-up update in https://github.com/
winterwindwang/Physical-Adversarial-Attacks-Survey. The
organization of the following paper is that we review the
physical adversarial attack against the image recognition
(4)
tasks in Section IV and object detection task in Section V.
In Section VI, we discuss challenges to be solved. Then we
provide some promising research directions for constructing
better physical adversarial examples. Finally, we make a
conclusion in Section VII.
IV. P HYSICAL A DVERSARIAL ATTACK ON I MAGE
R ECOGNITION TASK
Advanced deep learning techniques have been increasingly
deployed in daily life. For instance, facial recognition in au-
tomatic payment, image recognition techniques are employed
in auto checkout machines in the shopping center, and road
sign recognition in the computer-aid drive of the automated
vehicle. Therefore, a line of literature is proposed to investigate
the security of these systems. In this section, we will discuss
the existing physical attacks on image recognition tasks from
general image recognition, facial recognition, and road sign
recognition.
A. General image recognition
The early investigation of physical adversarial attacks
against image recognition mainly focuses on verifying the
possibility of physical attacks by printing the adversarial
image. Later, more realistic settings are explored, such as the
utilization of adversarial patches [59] or adversarial viewpoints
[61].
1) Iterative Fast Gradient Sign Method (I-FGSM): Unlike
exploring the adversarial examples in the digital world, Ku-
rakin et al. [55] investigated the possibility of adversarial
examples in the physical world. Specifically, the author op-
timized the adversarial examples by iterative updates along
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
Optimization
Robustness Transformation
Brightness
Rotate Resize
Adversarial /contrast
perturbation
Print out Stage 1: Optimize adversarial perturbation in digital space
Picture
Stick patch
Patch paper
Stage 2:Test the adversarial perturbation in physical space
Fig. 3. Overview of the physical adversarial attack process.
the direction of the gradient ascent multiple times in small
steps. The attack algorithm can be expressed as follows.
x0adv = x,
xN +1
 N N
adv = Clipx, xadv + αsign(∇x J(xadv , y))
where α controls the iterative step,  is the maximum al-
lowable modification over the image, Clipx, (·) is a function
to confine the discrepancy between adversarial examples and
clean image in . In physical attacks, the author printed
adversarial examples and used a phone to capture the photo
of adversarial examples. Experiment results suggested that the
printed adversarial examples can fool the image recognition
model.
2) EOT: To construct robust adversarial examples for phys-
ical attacks, Athalye et al. [49] proposed a general frame-
work to synthesize robust adversarial examples over a set of
transformation distributions, which called Expectation Over
Transformation (EOT). Specifically, they constructed the the
following optimization problem
argmin Et∼T [log P r(yt |t(x0 ))
x0
−λ||LAB(t(x0 )) − LAB(t(x))||2 ],
where the P r(yt |t(x0 )) represents the probability of t(x0 ) be
classified to yt , which is used to guarantee the adversarial;
LAB(·) is the color space convert function between RGB
space to LAB space, which used to ensure the perceptual of
adversarial perturbation. Note that, they develop an algorithm
to optimize the texture of 3D objects in 3D cases scenario.
In physical attacks, the author printed the 3D object and the
adversarial texture with the printer (3D), then wrapped the
adversarial texture over the 3D object. Evaluations were con-
ducted on the captured image, and the results suggested that
the multi-view captured images can fool the image recognition
model.
6
Patch applier Victim model
Loss
function
Physical test set
Victim model
3) D2P: Take further steps than [55], Jan et al. [53]
analyzed the discrepancy between the digital image and the
physical adversarial image, then proposed a method to model-
(5) ing such difference. Specifically, the author first collected enor-
mous digital-physical image pairs by printing digital images
and retaking them. Then, the author treated the transformation
between the digital and physical worlds as the image-to-
image translation and adopted a Pix2Pix model [106] or
a CycleGAN [107] to learn the translation mapping. Addi-
tionally, the EOT is adopted to boost the robustness of the
adversarial perturbation on the simulated physical image (i.e.,
the generator’s output). In physical attacks, the author printed
out the adversarial examples and retook them every 15 degrees
in the range of [-60, 60]. Experiment results suggest that their
attack outperforms the EOT and remains valid under different
visual angles. However, their attack is the full pixel attack,
which is impractical in practice.
4) ABBA: Guo [56] proposed a novel motion attack, which
exploits the blurring effect caused by object motion to fool
the DNNs. Specifically, the author optimized the specific
transform parameters for the object and background to create
(6) the blurring effect. The background is extracted by a binary
mask generated with a saliency detection model. Moreover, the
author used a spatial transformer network [108] to improve
the robustness of adversarial examples. In physical attacks,
the author captured the object image in the real world and
generated the adversarial blur examples by the devised method.
Then, the author moved the camera according to the optimized
transformation parameters to take the blurred image. Experi-
ment results show that the captured blurring image achieved
a success rate of 85.3%.
5) MetaAttack: Feng et al. [57] observed that the previous
D2P requires enormous amounts of manually collected data
and proposed to utilize the meta-learning technique to solve
the problem. Specifically, the author proposed to use GAN
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022 7

TABLE II
P HYSICAL ADVERSARIAL ATTACKS AGAINST IMAGE RECOGNITION TASKS . W E LIST THEM BY TIME AND TASK , ALIGNING WITH THE PAPER ’ S
DISCUSSION ORDER .

Adversarial’s Threat Adversarial Robust Physical

Method Year-Venue Space Remark Code
Knowledge Model Specificty Technique Test Type
I-FGSM [55] 2017-ICLR White-box Classification Targeted/Nontargeted - Static 2D Pixel-wise X
EOT [49] 2018-ICLR White-box Classification Targeted EOT Static 2D Pixel-wise ×
D2P [53] 2019-AAAI White-box Classification Targeted EOT,D2P Static 2D Pixel-wise X
ABBA [56] 2020-NeurIPS White-box Classification Nontargeted EOT Static 2D Pixel-wise X
MetaAttack [57] 2021-ICCV White-box Classification Targeted EOT Static 2D Pixel-wise ×
ISPAttack [58] 2021-CVPR White-box Classification Targeted/Nontargeted - Static 2D Pixel-wise ×
AdvPatch [59] 2017-NeurIPS White-box Classification Targeted EOT Static 2D Patch X
ACOsAttack [54] 2020-ECCV White-box Classification Nontargeted EOT Static 2D Patch X
ACOsAttack2 [29] 2021-TIP White-box Classification Nontargeted EOT Static 2D Patch X
TnTAttack [38] 2022-TIFS White-box Classification Targeted/Nontargeted - Static 2D Patch ×
Copy/PasteAttack [60] 2022-NeurIPS White-box Classification Targeted EOT,TV Static 2D Patch X
ViewFool [61] 2020-NeurIPS White-box Classification Nontargeted - Static 3D Position X
LightAttack [62] 2018-AAAI-S Black-box Classification Targeted/Nontargeted EOT Static 2D/3D Optical ×
ProjectorAttack [63] 2019-S&P White-box Classification Targeted - Static 2D Optical ×
OPAD [64] 2021-ICCV-W White-box Classification Targeted/Nontargeted EOT Static 2D Optical ×
LEDAttack [65] 2021-CVPR White-box Classification Targeted/Nontargeted EOT Static 2D Optical X
AdvLB [66] 2021-CVPR Black-box Classification Nontargeted - Static 2D Optical X
SLMAttack [67] 2021-arXiv White-box Classification Nontargeted - Static 2D Optical ×
SPAA [68] 2022-VR White-box Classification Targeted/Nontargeted D2P Static 3D Optical X
AdvEyeglass [51] 2016-CCS White-box FR Targeted/Nontargeted TV,NPS Static 2D Eyeglasses ×
AdvEyeglass2 [69] 2019-TOPS White-box FR Targeted/Nontargeted Color Adjust Static 2D Eyeglasses X
CLBAAttack [70] 2021-BIOSIG White-box FR Targeted/Nontargeted EOT Static 2D Eyeglasses ×
ReplayAttack [71] 2020-CVIU White-box FR Targeted/Nontargeted EOT,Position Adjust Static 2D Patch ×
ArcFaceAttack [72] 2019-SIBIRCON White-box FR Targeted/Nontargeted TV Static 2D Sticker ×
AdvHat [73] 2020-ICPR White-box FR Nontargeted TV,Bending Static 2D Sticker ×
TAP [74] 2021-CVPR White-box FR Targeted/Nontargeted EOT Static 2D Sticker ×
AdvSticker [39] 2022-TPAMI Black-box FR Targeted/Nontargeted Blending Static 3D Sticker X
SOPP [75] 2022-TPAMI Black-box FR Targeted/Nontargeted - Static 2D Sticker X
AdvMask [76] 2022-ECMLPKDD White-box FR Targeted/Nontargeted Rendering Static 3D Mask X
LPA [77] 2020-CVPR-W White-box FR Targeted/Nontargeted Position/Color Adjust Static 2D Opitcal ×
RP2 [46] 2018-CVPR White-box TSR Targeted/Nontargeted D2P Static 3D Patch ×
RogueSigns [78] 2018-arXiv White-box TSR Targeted EOT Dynamic 2D Pixel-wise X
PS GAN [79] 2019-AAAI White-box TSR Nontargeted - Static 2D Patch ×
AdvCam [80] 2020-CVPR White-box TSR Targeted/Nontargeted EOT Static 2D Pixel-wise X
ShadowAttack [81] 2022-CVPR Black-box TSR Nontargeted EOT Static 2D Optical X
AdvPattern [82] 2019-CVPR White-box ReID Targeted/Nontargeted EOT,TV Static 2D Patch X
PhysGAN [83] 2020-CVPR White-box SteeringModel Nontargeted D2P Dynamic 2D Pixel-wise ×
LPRAttack [84] 2020-C&S Black-box LPR Targeted - Static 2D Patch ×
Venue: Venue with postfix “-S” and “-W” indicates the symposium and workshop. C&S : Computers & Security. CVIU: Computer Vision and Image Understanding.
Threat Model: FR: Face Recognition. TSR: Traffic Sign Recognition. LPR: License Plate Recognition.
- in Robust Technique indicates that there are no specific techniques to enhance physical robustness.

remain physically aggressive when printed out and retaken by

[57]
[55] [53] [58]
Fig. 4. Examples of physical adversarial example for general classification.
to generate adversarial examples. The generator’s parameters
are trained via the meta-learning technique: for each task, the
training set was split into the support set and query set, where
the former is used to train the GAN, and the latter is used
to validate it. The generator is trained on multi-tasks and
fine-tuned on the new tasks in a few-shot learning manner.
Moreover, EOT is adopted to enhance physical robustness. The
physical experiments suggested that the captured adversarial
image obtained a success rate of 95.2%.
6) Attack Imaging pipelines: Unlike modifying the pixel
of the RGB images, Phan et al. [58] proposed to modify the
RAW image that outputs from the camera device directly,
which makes it robust to compression (i.e., JPEG). They
demonstrated that perturbations devised for RAW images
the camera.
7) Adversarial patch (AdvPatch): Concurrent to [49],
Brown et al. [59] first presented a general framework to
construct the adversarial patch, which is robustness under a
variety of transformations. Given that a small perturbation
cannot deceive the adversarial defense techniques, the author
discarded the constraint on the magnitude of the adversarial
patches and proposed to use a large perturbation to attack
defense techniques. Specifically, they replaced a partial pixel
of the image with the optimized adversarial patch and defined
the patch application operator A(p, x, l, t) to implement the
replacement. A(δ, x, l, t) means applies the transformation t to
the patch δ, and then paste patch δ to the image x at location
L. To construct the robust adversarial patch, they combine the
EOT and propose the following optimization problem
δ̂ = argmin Ex∼X,t∼T ,l∼L [log P r(yt |A(δ, x, l, t))]
δ (7)
+||δ||∞ .
By solving the above problem, one can obtain the adver-
sarial patch that could successfully mislead the DNN-based
application to output the specific class yt on the smartphone.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022 8

TABLE III
P HYSICAL ADVERSARIAL ATTACKS AGAINST OBJECT DETECTION TASKS . W E LIST THEM BY TIME AND TASK , ALIGNING WITH THE PAPER ’ S DISCUSSION
ORDER .

Adversarial’s Threat Adversarial Robust Physical

Method Year-Venue Space Remark Code
Knowledge Model Specificty Technique Test Type
ShapeShifter [45] 2018-ECMLPKDD White-box OD Targeted/Nontargered EOT Dynamic 2D Pixel-wise X
RP2+ [50] 2018-USENIX-W White-box OD Targeted/Nontargered TV,NPS,D2P Static 2D Patch ×
AdvPatch [47] 2019-CVPR-W White-box OD Nontargered EOT,TV,NPS Dynamic 2D Patch X
NestedAE [85] 2019-CCS White-box OD Targeted/Nontargered D2P, Physical Adjust Dynamic 3D Patch ×
DPatch2 [86] 2019-ICML White-box OD Targeted/Nontargered EOT Static 2D Patch ×
LPAttack [87] 2020-AAAI White-box OD Targeted EOT,TV,NPS Static 2D Pixel-wise ×
TranslucentPatch [88] 2021-CVPR White-box OD Targeted/Nontargered Affine,NPS Static 2D Patch ×
SwitchPatch [89] 2022-arXiv White-box OD Targeted TV Static 2D Patch ×
ScreenAttack [90] 2020-arXiv White-box OD Targeted TV Static 2D Patch ×
Invisible Cloak1 [91] 2018-UEMCON White-box OD Nontargered EOT,TV Static 3D Wearable Patch ×
Adversarial T-Shirt [92] 2020-ECCV White-box OD Targeted EOT,TPS Static 2D Wearable Patch ×
Invisible Cloak2 [93] 2020-ECCV White-box OD Nontargered TPS Static 2D Wearable Patch X
LAP [94] 2021-MM White-box OD Nontargered TV,NPS Static 2D Wearable Patch ×
NaturalisticPatch [95] 2021-ICCV White-box OD Nontargered TV Static 2D Wearable Patch X
AdvTexture [96] 2022-CVPR White-box OD Nontargered EOT,TPS Static 2D Wearable Patch X
SLAP [97] 2021-USENIX Security White-box OD Nontargered EOT,TV Static 2D Optical X
MeshAdv [98] 2021-CVPR White-box OD Nontargered - Static 3D Shape ×
CAMOU [99] 2019-ICLR White-box OD Nontargered EOT Static 2D Camouflage ×
ER [100] 2020-arXiv Black-box OD Nontargered - Static 3D Camouflage ×
UPC [48] 2020-CVPR White-box OD Targeted/Nontargered EOT Static 3D Camouflage X
DAS [30] 2021-CVPR White-box OD Nontargered TV Static 3D Camouflage X
FCA [33] 2022-AAAI White-box OD Nontargered TV Static 3D Camouflage X
CAC [34] 2022-IJCAI White-box OD Targeted EOT Static 3D Camouflage ×
DPA [35] 2022-CVPR White-box OD Nontargered EOT Static 3D Camouflage ×
BulbAttack [31] 2021-AAAI White-box IR OD Nontargered EOT,TV Static 2D Optical ×
QRAttack [32] 2022-CVPR White-box IR OD Nontargered EOT Static 2D Patch ×
AerialAttack [101] 2022-WACV White-box ODAI Targeted EOT,TV,NPS Dynamic 2D Patch X
RWAE [102] 2022-WACV White-box SS Nontargered EOT Static 2D Patch X
MDEAttack [103] 2022-ECCV White-box MDE Nontargered EOT Static 2D Patch ×
PATAttack [104] 2019-ICCV White-box OT Targeted/Nontargered EOT Dynamic 2D Patch ×
MTD [105] 2021-AAAI White-box OT Targeted EOT,TV Dynamic 2D Patch ×
OD: Object Detection. SS: Semantic Segmentation. MDE: Monocular Depth Estimation. IR OD: Infrared Object Detection. ODAI: Object deTection in Aerial Images. OT: Object Tracking.
Venue with postfix “-W” indicates the workshop.
- in Robust Technique indicates that there are no specific techniques to enhance physical robustness.

However, lacking constraint on perturbation results in the odd
appearance of the adversarial patch.
8) ACOsAttack: The previous physical attacks failed to
explore the DNN-based application in real life, Liu et al.
[29], [54] proposed optimizing a universal adversarial patch to
attack the real deployed automatic check-out system (ACOs).
Specifically, the author exploits models’ perceptual and se-
mantic biases to optimize the adversarial patch. Regarding
the perceptual bias, the author used hard examples which
convey strong model uncertainties and extracted the textural
patch prior from them in terms of the style similarities.
To alleviate the heavy dependency on large-scale training
data, the author exploited the semantic bias by collecting
many prototypes with respect to the different classes, then
trained the universal adversarial patch on the prototype dataset.
Moreover, the author also adopted the EOT to improve the
robustness of the adversarial patch. In physical attacks, the
author printed the adversarial patch and stuck them on the
commodities, then captured it from different environmental
conditions (i.e., angles {−30◦ , −15◦ , 0◦ , 15◦ , 30◦ } and dis-
tances {0.3, 0.5, 0.7, 1})(meter). Experiment results suggested
that the captured images with the adversarial patch easily
deceive the system. Additionally, their attack could degrade the
recognition accuracy of the prevalent E-commerce platforms
(i.e., JD and Taobao) on the test set by 43.75% and 40%.
9) TnTAttack: Recently, Bao [38] et al. pointed out the
existing physical adversarial patches are visually conspicuous.
To address the issue, the author proposed to exploit a generator
to construct naturalistic adversarial patches. Unlike crafting
full-pixel adversarial examples with GAN [109], the author
first train a generator to map the latent variable z (i.e., random
noise) to the realistic image patch, which will be embedded in
the image. In the second stage, the author fixed the generator’s
parameters, then used the gradient-based optimization method
with the guide of adversarial loss to seek the optimal latent
variable z, which generates the visual naturally adversarial
patch. Their approach is based on the fact that the trained
generator could map the randomly sampled latent variable
z to a naturalistic image, in which one latent space can be
mapped to the naturalistic adversarial patch. In such a way,
the author significantly reduced the optimization variable (only
100-dimension latent variables z). In physical attacks, the
author printed the patch image and stuck it on the front of
clothes, then captured a 1-minute video of the person who
wore the clothes with the adversarial patch. Experiment results
suggested that over 90% of captured images in frames can fool
the target network.
10) Copy/Paste Attack: Inspired by the ringlet butterfly’s
predators being stunned by adversarial “eyespots” on its
wings, Casper [60] speculate that the DNNs are fooled by
interpretable features in the real world. To this end, the author
proposed to develop adversarial perturbation that can reveal
the weakness of the victim network. Specifically, the author
used GAN to create the patch, which is pasted on the target
image that is classified as the specific target class by the
target model. Additionally, EOT is adopted to improve the
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
adversarial patch’s robustness, and TV loss is adopted to
discourage high-frequency patterns. In physical attacks, the
author printed the adversarial patch and pasted it on the
object. Evaluation results on the recaptured image verify the
effectiveness of their method in the real scenario.
11) ViewFool: Unlike generating the adversarial perturba-
tion by modifying the pixel of images, [61] suggested the
existence of adversarial viewpoints in the real world, which
means that the image taken at a specific view is sufficient to
fool the model. To search such viewpoints, the author treats the
coordinate and orientation (i.e., yaw, roll, pitch) of the camera
in the world axis as the optimization variables and exploits the
NeRF to render the object with the searched coordinate and
orientation. In physical attacks, the author takes pictures from
adversarial viewpoints and evaluates the attack performance.
Experiment results suggest that DNN models are vulnerable
to adversarial viewpoints.
12) Optical attacks: Unlike adversarial patch attacks, op-
tical attacks are more stealthy and controllable as the attacker
is not required to modify the target object. One representative
characteristic of optical attacks involves the projector-camera
model, a process for improving the robustness of physical
attacks. It refers to projecting the adversarial perturbation into
the real world by the projector and recapturing it by the
camera for evaluation. For this reason, Nichols et al. [62]
first collected hundreds of real projected and captured image
pairs as the training dataset, then they got inspiration from the
one-pixel attack and adopted the differential evolution (DE) to
optimize one pixel as the projection point in the low-resolution
image (e.g., 32 × 32). In physical attacks, the author projected
the light over the specific area of the object and recaptured
it. Experiment results demonstrate the effectiveness of light
attacks.
In contrast to [62], Man et al. [63] performed physical
attacks by projecting a light source over the whole image.
Specifically, to ensure the emitted light can impact the image
to fool the classifier, the author treated the color distribu-
tion (the means and the standard deviations of the Gaussian
distribution) of light as an optimization problem. In physical
attacks, the author modulated the projector’s color (the value
of RGB) to emit the light to the displayed image, then took
the photo for testing. Cased studies verify the effectiveness of
physical attacks. Gnanasambandam et al. [64] considered the
projector factor and devised a transform function consisting
of a matrix and an offset to mimic the process of converting
images to the physical scene, where the matrix is used to
transfer the image to projector space; and the offset is used
to counteract the background illumination. In optimization, the
transform function is performed first, followed by the gradient-
based algorithm (i.e., PGD [12]). Concurrent to [64], Kim et
al. [67] modulated the phase of the light in the Fourier domain
using a spatial light modulator (SLM) to yield the adversarial
attack, where the modulator’s parameters are optimized with
gradient-based algorithms. Sayles et al. [65] modulated a light
signal to illuminate the object then its surface displays striping
patterns, which could mislead the classifier to make a mistake
in physical attacks. Duan et al. [66] modulated a laser beam
to perform adversarial attacks, where the laser’s wavelength,
9
[62] [63] [64]
[65] [67] [66] [68]
Fig. 5. Examples of optical attacks.
layout, width, and intensity are optimized by random search.
Recently, Huang et al. [68] proposed a stealthy projector-
based adversarial attack (SPAA) method, which formulated
the physical projector attack as an end-to-end differentiable
process. Specifically, the author devised a PCNet to approx-
imate the project-and-capture process, which could optimize
the adversarial perturbation on the projected-captured image
pairs under the guidance of adversarial loss and stealthiness
loss. In physical attacks, the author projected the adversarial
perturbation on the target object 1.5 meters away from the
projector and recaptured it for evaluation. Experiment results
demonstrated that the stealthy adversarial perturbation gener-
ated by SPAA could deceive the DNN significantly.
Figure 5 illustrates examples of various optical attack
methods. However, despite its stealthiness and controllability,
optical attacks are constrained by many factors, such as
the object’s surface material, the color’s saturation, and the
scene’s light intensity. However, despite its stealthiness and
controllability, optical attacks are constrained by many factors,
such as the object’s surface material, the color’s saturation, and
the scene’s light intensity.
13) AdvPattern: In contrast to the image recognition task,
Wang et al. [82] first attempted to implement the physical ad-
versarial attack against the person re-identification (re-ID). To
improve the physical robustness of the adversarial pattern, they
devise a degradation function (i.e., a kind of data augmentation
technique) that randomly changes the brightness or blurs the
adversary’s images from the augmented generated set, which
is constructed by a multi-position sampling strategy. Such a
strategy is essentially used to boost the performance of an
attack under a multi-camera view. For the physical adversarial
experiment, the author printed out the adversarial pattern and
attached it to the adversary’s clothes, and applied the physical
attack under the condition of distance (4 ∼ 10 meter) and
angle (12◦ ∼ 47◦ ).
B. Facial Recognition
Facial recognition is a technique to match a human face
from a digital image or video frame against a database of
faces. In general, the first step of facial recognition is to
extract the face area of the input image and feed it into
the facial recognition system to predict/match the concrete
person. Thus, the adversarial attack against facial recognition
can be categorized into dodging and impersonation attacks;
the former refers to the adversary seeking the adversarial
perturbation to mislead the face to the specific face, while
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
(a) (b) (c) (d)
Fig. 6. Examples of adversarial glasses for dodging and impersonation attacks
of [51] (a,b) and [69] (c,d).
the latter refers to the attacked face that can be misidentified
as other face except the original one. Actually, the dodging
and impersonation attack is analogous to the untargeted and
targeted attacks, respectively. Specifically, physical attacks
against the facial recognition system to output the incorrect
person (impersonation attack) or undetected result (dodging
attack) by modifying the accessorize of the face, e.g., eye-
glasses frame [51], [69], hat [73], sticker [39], or even makeup
[110].
1) Eyeglass attack: Sharif et al. [51] first investigated the
physical adversarial attack against face recognition models.
To attack the face recognition model, they taken the facial
accessory (i.e., eyeglasses) as the perturbation carrier. The
robustness of the single perturbation is enhanced by training
it on a set of images, making it remain works under different
imaging conditions. Additionally, the TV loss [52] is adopted
to improve the smoothness of perturbation and designed the
NPS loss to ensure the printability of perturbation. Finally, the
author optimizes the perturbation by constructing the following
optimization problem
X and [69].
argmin(( sof tmaxloss(x + δ, yt ))
δ x∈X (8)
+κ1 · T V (δ) + κ2 · N P S(δ)),
where sof tmaxloss is the adversarial loss for the face recog-
nition system, κ1 and κ2 balance the objectives. To conduct
the physical experiment, the author printed and cropped out
the adversarial eyeglass frame and stuck it on the actual pair
of eyeglasses. Then, the author asked the trial participant to
wear eyeglasses and stand at a fixed camera distance in the
indoor environment and then collected 30-50 images for each
participant. Experiment results suggested that their adversarial
eyeglass frame easily deceives face recognition.
Although the eyeglasses frame generated by [51] deceive
facial recognition to some extent, Sharif et al. [69] argued
that the appearance of the eyeglasses frame is conspicuous. To
craft an inconspicuous eyeglass frame, the author proposed to
use a generative model to craft the adversarial glasses frame
with a natural pattern. Specifically, the author first collected
enormous images of real glasses frames as the training set;
Then trained an adversarial generative network (AGN) with
the following loss function, i.e., Equation 9 and 10 for the
untargeted and targeted attack, respectively.
10
X
Luntargeted
G = lg(1 − D(G(z)))
z∈Z
X (9)
−κ( Fyi (x + G(z)) − Fgt (x + G(z))),
i6=x
X
Ltargeted
G = lg(1 − D(G(z)))
z∈Z
X (10)
−κ(Fyt (x + G(z)) − Fyi (x + G(z))),
i6=t
where the z is sampling from a distribution Z, D(·) and G(·)
are the output of discriminator and generator, respectively. Fyt
and Fyi are the network’s softmax output of the ground-truth
label yt and another label yi . lg(·) is the logarithmic function
and κ is the weight to balance the loss function. By minimizing
the loss function, the generator learns to craft realistic glasses
frames with adversarial. To further enhance the robustness of
the adversarial glasses in physical attacks, the author intro-
duce the following three methods. The first one is to utilize
multiple images of the attacker to improve the robustness of
adversarial glasses under different conditions. The second is
to collect various pose images to make the attacks robust to
pose changing. The third is to use the Polynomial Texture
Maps approach [111] to confine the RGB value of eyeglass
under baseline luminance to values under a specific luminance,
making the attacks robust to varying illumination conditions.
In physical attacks, the author printed out the eyeglasses frame
and adversarial pattern, stuck them over the eyeglasses frame,
and then recaptured images for evaluation. Experiment results
show that their method outperforms [51] by the improvement
of 45% under different physical conditions (i.e., head pose
covered 13.01◦ pitch, 17.11◦ of yaw, 4.42◦ of roll). Figure 6
illustrates the printed adversarial eyeglasses generated by [51]
Later, Zhang et al. [71] demonstrated that the face authen-
tication system equipped with the DNN-based spoof detection
module is still vulnerable to the adversarial perturbation. They
got inspiration from EOT [49] and train the perturbation over
a serial of transformations (i.e., affine, perspective, brightness,
gaussian blurring, and hue and saturation). In performing
physical attacks, The author displayed the face image with
adversarial perturbation on the screen and then captured it by
the cellphone under different views (angles in −20◦ ∼ 20◦ ,
distances in 10 to 50 cm). Experiment results suggested that
the target system is fragile to the adversarial face image.
Recently, Singh et al. [70] leveraged the concept of curricu-
lum learning to promote the robustness of attack to changing
brightness against the facial recognition model. In optimiza-
tion, the author constantly changes the brightness of face
images stuck with adversarial eyeglasses, which makes their
attack robust to brightness changes. Physical attacks verify the
effectiveness of the attack against the brightness change.
2) Sticker: Unlike treating the eyeglasses as the pertur-
bation carrier, Pautov et al. [72] proposed a simple but
effective method to craft the adversarial sticker to deceive face
recognition. To apply the adversarial sticker over the facial
area, the author applied the projective transformation over the
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
Fig. 7. Bend and rotation over the rectangle [73]. The length of the rectangle
do not change.
adversarial sticker, then stuck the sticker on the nose or eye
of the adversary. To optimize the sticker, the author treats
the cosine similarity between the image embedded with the
patch and the original clean image as adversarial loss, which
is expressed as follows.
L(X, δ) = Et∈T ,x∈X [cos(ext , exadv )] ,
where ext and ex0 are the embedding corresponding to the
desired person xt and the photo xadv of the attacker with the
applied patch. In addition, TV loss is adopted to constrain
the visual effect of the adversarial sticker. To avoid the color
discrepancy between the physical and the digital perturbation,
the author chooses to optimize the sticker on a grayscale. They
conduct the physical attack by printing out various shapes (i.e.,
eyeglasses and stickers) of stickers and stick on a specific
area of the face. Experiment results show that their sticker
can dramatically deteriorate FaceID models.
Komkov et al. [73] devised the adversarial sticker with
the rectangle shape, which is stuck on the hat to attack
the FaceID model. To optimize the adversarial sticker for
the hat, the author first applied the bends and rotation (see
Figure 7) transformation over the sticker to approximate the
actual sticker process, which is realized by performing a
differentiable formula on the pixel. The adversarial loss (i.e.,
cosine similarity distance) and TV loss are adopted to optimize
the adversarial sticker. In physical attacks, the author stuck the
adversarial sticker on the forehead area of the hat. Experiment
results show that the person wearing the generated adversarial
sticker easily bypasses the Face ID system (e.g., ArcFace).
Concurrent to [73], Xiao et al. [74] proposed to improve
the transferability of the adversarial patch for face recogni-
tion systems. The author analyzes the drawback of existing
transferability methods: sensitive to the initialization (e.g.,
MIM [13]) and exhibits severe overfitting to the target model
when the magnitude of perturbation is substantial. To address
these issues, the author regularizes the adversarial patch in a
low-dimensional manifold represented by a generative model
regularization. In optimization, the adversarial patch is bent
and pasted on the eye area of the face. The author conducts the
physical attack by printing and photographing the adversarial
patch stuck in the human eye and achieves successful attacks.
Unlike optimizing the pattern or color of adversarial per-
turbation to perform attacks, Wei et al. [39] claimed that the
natural image patch is sufficient to attack facial recognition
models. Specifically, the author proposes a general framework
for searching the most sensitive area of the model that is
susceptible to the sticker. The author first locates the most vul-
nerable area by traversing the face image with a patch image,
which accelerates the search speed. In optimization, the author
11
used the bend and rotation transformation in the 3D space to
transform the adversarial patch to mimic the deformation of
the sticker on the real face. In physical attacks, the author
sticks the adversarial patch on the attacker’s face according to
the searched coordinate. Experiment results demonstrated that
the natural image patch stick at the searched areas is sufficient
to degrade the performance of DNN in digital and physical
conditions.
Recently, Wei et al. [75] found that the position and the
pattern of adversarial patches are equally significant to a suc-
cessful attack. Thus, the author optimizes the positions and si-
multaneously perturbation against the face recognition model.
Specifically, the author used a UNet architecture to generate
the position and the attack step of the existing gradient-based
(11) algorithm (e.g., I-FGSM [55]) to reduce the optimization vari-
ables. In optimization, the author adopted the reinforcement
learning framework to model the above problem, where the
agent is the UNet, the policy is the sampling strategy in the
agent, the action is specific optimization variables obtained
by policy, and the rewards are generated by querying the
ensemble model with the constructed adversarial examples. In
physical attacks, the author printed the adversarial patch with
photo paper as it can reduce the color discrepancy as much
as possible. Experiment results on their method achieved an
average success rate of 66.18% on captured images.
In the prevalence of the COVID-19 pandemic, wearing
masks has become common sense. Zolfi et al. [76] got
inspiration from this and generated a mask-like universal
adversarial patch, which makes the attack more stealthy. The
adversary who wears the crafted adversarial mask can bypass
the face recognition systems in some scenarios, e.g., airport.
Specifically, the author proposed a mask projection method to
convert the faces and masks into UV space to mimic actual
wearing. The mask image is optimized by minimizing the
cosine similarity loss and TV loss to ensure adversarial and
smoothness. In addition, geometric transformations and color-
based augmentations are adopted to improve the robustness
of the mask. To perform physical attacks, the author makes
the mask with two different materials regular paper and white
fabric mask. The author recruited a group of 15 male and
15 female participants to wear the different devised masks,
and the experiment result demonstrated that the model’s per-
formance declined significantly (i.e., from 74.83% to 5.72%,
4.61% for paper and fabric mask) on the face wore the
adversarial mask.
3) Light Projection Attack (LPA): Unlike the adversarial
perturbation patch approaches, Nguyen et al. [77] exploited
the adversarial light projection to attack the face recognition
systems. The critical technique of the light project attack
is calibrating the adversarial region and color between the
projector and digital images. To address the issue, the author
proposed two calibration approaches (i.e., manual assign and
automatic obtain with a landmark detection) to constrain the
adversarial area to calibrate the position. To calibrate the
color between the digital adversarial pattern and the physical
version of adversarial light emitted by the projector, the author
presented a color transformation function γ (Equation 12)
to implement the conversion between the camera (C) and
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
[72] [110] [74] [70]
[73] [77] [76] [39]
Fig. 8. Examples of adversarial stickers or light projections.
projector (G).
C(x̂adv + G(γ(h(x)))) = x + h(x)
⇐⇒ C(x̂adv ) + C(G(γ(h(x)))) = x + h(x)
(12)
⇐⇒ C(G(γ(h(x)))) = h(x)
⇐⇒ γ = (C G)−1 ,
where x̂adv is the physical adversarial example, h(x) repre-
sents the algorithm to search adversarial perturbation. Addi-
tionally, the author pointed out that γ in Lab color space can
better approximate the physical domain RGB color space. In
physical attacks, the author projects the adversarial light on
the adversary’s face to attack the facial recognition model.
To sum up, the main attack pipeline against facial recog-
nition can be briefly described as follows. First, apply the
adversarial perturbation precisely over the face area using bend
and rotation or 2D/3D conversion via rendered. Meanwhile,
a set of transformations or data augmentation are utilized to
improve the robustness. Finally, the cosine similarity-based
adversarial loss [70], [72], [73], [76], [77] and TV loss or
NPS loss to ensure the physical deployable. Figure 8 display
the examples generated by different methods.
C. Traffic sign recognition
Traffic sign recognition is one of the widely used applica-
tions of the DNN model, which can be deployed in various
scenarios, such as road sign recognition in automatic driving
or license plate recognition in auto-checkout parking lots.
Therefore, a line of work has been proposed to explore the
security risk of these models.
1) RP2 : Eykholt et al. [46] first demonstrated that the road
sign recognition model is vulnerable to physical adversarial
attack. The author proposed to optimize multiple white-black
blocks with rectangle shapes. Specifically, the author first
collected considerable physical traffic sign images as the
training set to improve the robustness of adversarial patches
to various physical environmental conditions. Moreover, to
eliminate the color discrepancy between the digital adversarial
patch and the printed physical adversarial patch, they adopt the
NPS loss to constrain the color of the adversarial patches. Fi-
nally, the author formulated the optimization of such physical
deployable adversarial patches as the following optimization
formal.
12
argmin λ||Mx · δ||p + N P S
δ (13)
Exi ∼X V J(f (xi + Ti (Mx · δ)), y),
where the Mx is the binary mask of the location patches,
and X V is the training dataset consisting of digital and
physical examples. In physical attacks, the author performs the
experiments under various camera distances (i.e., 1.5, 3, and
12 meters) and angles (i.e., 0◦ ∼ 15◦ ) on the adversarial patch.
Additionally, they also conduct dynamic physical attacks by
recording the video while driving the car toward the adversar-
ial traffic sign. Experiment results suggested that their method
can dramatically deceive the stop sign recognition model.
Additionally, the author empirically found that 1) adversarial
performance is easily impacted by the location of the mask;
2) the mask optimized by L1 regularization show more sparse
that represents the most vulnerable of the model, while the L2
result in successful attacks at an earlier iterative step.
Concurrent to [46], Sitawarin et al. [78] proposed a general
attack pipeline, which can generate the adversarial logo, traffic
sign, and custom adversarial sign. In optimization, the author
used a circle mask to ensure perturbation is added to the target
area (e.g., traffic sign). In addition, a set of transformations is
used to ensure robustness. Finally, the adversarial perturbation
is optimized by minimizing the C&W adversarial loss [14]. To
perform dynamic physical attacks, the author drove a car and
recorded the video to capture the adversarial sign from far
(80 feet away) to near. Experiment results showed their attack
could achieve a 95.74% of attack success rate.
2) PS GAN: Unlike the optimization-based attacks, Liu et
al. [79] proposed to utilize the generative model to construct
inconspicuous adversarial patches. Specifically, the author
exploited the attention map extracted by the Grad-CAM [112]
to guide the paste location of adversarial patches for better
attack performance. Meanwhile, they minimized the discrep-
ancy between the adversarial patch and the seed patch for
better visual fidelity. Finally, they adopt GAN loss, adversarial
loss, and the L2 -norm loss that is calculated by the seed patch
and the output of the generator to optimize the perturbation.
In physical attacks, the author printed the adversarial patch
and stuck it on the traffic sign (i.e., “Speed Limit 20”) in the
street with varying angles (e.g., {0◦ , 15◦ , 30◦ , −15◦ , −30◦ })
and distances (e.g., {1, 3, 5}m). Experiment results suggested
that most of the captured traffic sign images pasted with
adversarial patches are misclassified by the model (from 86.7%
to 17.2%).
3) AdvCam: Take further step than [79], Duan et al. [80]
proposed a novel approach to camouflage the adversarial
perturbation (i.e., AdvCam) into a natural style that appears
legitimate to human observers. Specifically, they exploited the
style transfer technique [113] to hide the large magnitude
perturbations into customized styles, which makes attacks
more stealthy. They adopt the following adversarial loss to
maintain the aggressive
(
log(pyadv (xadv )), for targeted attack
Ladv = (14)
− log(py (xadv )), for untargeted attack,
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
where pyadv (·) is the probability output (softmax on logits) of
the target model f with respect to class yadv . The style loss
and content loss were adopted to ensure style transfer and the
TV loss is introduced to reduce the variations between adjacent
pixels. Additionally, the author utilized various physical condi-
tions (i.e., rotation, scale size, and lighting change) to boost the
robustness of adversarial patterns in the real world. Moreover,
the author experimentally demonstrated that the location and
shape of the adversarial pattern had limited influence on the
attack performance, e.g., the attack was valid even though the
adversarial patch was far from the object. In physical attacks,
the author prints the adversarial pattern on paper and then
photos it at various angles and distances. Experiment results
demonstrate the effectiveness of their approaches in physical
attacks. However, although the generated adversarial examples
with well stealthy, using the generated whole adversarial object
(i.e., stop sign) to apply an attack is impractical in the real
world.
4) PhysGAN: In general, simulating real physical transfor-
mations is impossible in the digital world. Unlike adopting
EOT to improve the physical robustness of adversarial patches,
Kong et al. [83] proposed a novel method to learn physical
transformation from videos recorded in the real world by using
a generative model (i.e., PhysGAN), which is then used to
optimize the physical robust adversarial patch. Specifically,
the author placed the adversarial poster on the target object
of the video frame and fed it into a video feature extractor.
The extracted features are simultaneously fed into the gen-
erator and the final classification head to calculate the loss.
The author maximizes the distance between the clean and
adversarial video in the classification output to ensure the
adversarial of generated posters. Combined with the GAN’s
loss, the trained adversarial poster preserves stealthiness and
can deceive the target model. In physical attacks, the author
printed the adversarial poster and placed it on the side of
the road, then recorded the video when driving past the
adversarial poster. Experiment results show that the steer
angle classification model is fragile to the physical printed
adversarial poster.
5) ShadowAttack: Recently, Zhong et al. [81] argued that
the pattern of perturbations generated by prior approaches is
conspicuous and attention-grabbed for human observers. To
this end, the author proposed to utilize the natural phenomenon
(i.e., shadow) to perform physical attacks. Specifically, the
author considers the shadow location and value to create the
shadow. For shadow location, the author fund an appropriate
polygon determined by a set of vertices. Regarding the shadow
value, the author uses the LAB color space rather than RGB
to search for the optimal illumination component. Finally, the
author finds the best shadow by exploiting the particle swarm
optimization (PSO) strategy. Additionally, EOT was adopted
to improve the robustness of the shadow attacks. In physical
attacks, according to the optimized digital shadow, the author
used a triangle board to create a shadow over the traffic sign.
Experiment results suggested that the shadow attack could
achieve the fooling rate of 95% in real-world scenarios.
Additionally, the license plate recognition (LPR) model has
been demonstrated to be vulnerable to physical adversarial
13
RP2 [46] AdvLogo [78] Ph GAN [79] AdvCam [80] PhysGAN [83] ShadowAttack [81]
Fig. 9. Examples of adversarial examples against traffic sign recognition.
attacks [84]. Rather than optimize the perturbation over the
while image pixel, Qian et al. [84] proposed to optimize the
best position where to paste the adversarial patch. Specifically,
the author first cut out characters of the plate and selected
the victim character. Then the position to be pasted with the
rectangle black block is optimized by the genetic algorithm.
The author reveals that different license plate characters show
different attack sensitivity. To perform physical attacks, the
author first collects the car plate from the real world, then
optimize the optimal position for attack. After that, the author
pastes the black sticker on the real car plate at the optimized
location and captures the image for evaluation. Experiment
results show the vulnerability of the LPR model to physical
adversarial attacks.
In summary, the examples of various physical attack against
the traffic sign recognition model is provided in Figure 9.
V. P HYSICAL A DVERSARIAL ATTACK ON O BJECT
D ETECTION TASK
Object detection is a technique to locate and classify the
object in the image, which is widely applied in video surveil-
lance and automatic driving, where the target object is the
vehicle, pedestrian, traffic sign, and so on. Existing object
detectors can be divided into single-stage detectors and two-
stage detectors. Single-stage detectors output the detection
results directly, and the typically single-stage detectors include
the YOLO series [44], [114], SSD [115], RetinaNet [116], and
so on. By contrast, the two-stage detector first extracts the
feature with respect to input via a backbone, then performs
classification and regression over the feature to obtain the cat-
egories and bounding boxes. The typically two-stage detector
includes Faster RCNN [117], Master RCNN [118], and so on.
Nonetheless, both single-stage and two-stage object detectors
have three outputs: bounding boxes, objectness, and category.
Bounding boxes locate the possible object in the image, where
objectness gives the confidence that the located area contains
the object, and category give the classification results.
Performing the adversarial attack against object detection
at least requires modifying one of three outputs, making it
more challenges than attacking the image recognition tasks.
The main way to perform a physical adversarial attack against
object detection is to modify the attributes (e.g., appearance) of
the object, including adversarial patch, adversarial camouflage,
and other novel approaches (e.g., emitting the laser toward
the object). Although the pixel-wise adversarial examples can
also realize physical adversarial attacks by printing the image
with adversarial perturbation, we ignore them because it is
unrealistic for the adversary to modify the whole environment
in practice.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022 14

A. Patch-based physical adversarial attack

Patch-based physical attacks mainly focus on generating the
adversarial patch for the plane object. The most remarkable
advantage is that it is easily deployable in physical attacks as
the adversary can perform attacks by only printing it out and
hanging it. Such a characteristic makes it a suitable carrier for
perturbation in physical attacks.
1) ShapeShifter: Chen et al. [45] first demonstrated that the
EOT could be applied to improve the robustness of adversarial
patches in attacking two-stage object detectors (i.e., Faster Fig. 10. Visualization of adversarial patch hiding the person under the
RCNN [117]). The optimization based on C&W attack [14] is surveillance camera. [47]
formulated as follows.

1 X author captured the video of the adversarial object beginning

argmin Ex∼X,t∼T [ Lfi (Mt (xadv ), y)] away from 9 meters for the disappearance attack. By contrast,
xadv ∈Rh×w×3 m
ri ∈rpn(Mt (xadv )) in the creation attack setting, they placed the adversarial
+c · || tanh(xadv ) − xo ||22 , patch on the wall or cupboard and captured the video from
(15) toward the adversarial object, away from 3 meters. The exper-
iment result shows that the adversarial patch can mislead the
where Mt (xadv ) = (Mt (x, tanh(xadv ) is an operation that
YOLOv2 in most cases, demonstrating its fragility in practice.
transforms an object tanh(xadv ) using t and then paste it into
In addition, the experiment suggests that the indoor attack
the background image x with a binary mask; rpn represent
performs well than the outdoor attack, which can be attributed
the region proposal represented extracted by the first stage of
to the complex environment in the outdoor conditions.
Faster RCNN; the Lfi (Mt (xadv ), y) is the loss function of
The previous works [46], [59] were concentrated on the
classification in the i-th region proposal; the last term is a
no intra-class variety (e.g., stop sign). To this end, Thys et
regularization term that is used to balance the attack strength
al. [47] proposed to generate adversarial patches for intra-
and the quality of the adversarial patch. In physical attacks,
class variety (i.e., persons). They aim to hide the person
the author conducted extensive static and dynamic attacks
who holds the printed adversarial patch cardboard plate and
under multi-view conditions. The experiment demonstrated the
towards the device with the object detector application. In
vulnerability of the object detector and the feasibility of the
optimization, the author designed an algorithm to place the
physical adversarial attack.
adversarial patch in the center of the detected object, then
2) DPATCH: Inspired by the adversarial patch in image
adopted the objectness output as the adversarial loss, which
recognition tasks [59], Liu et al [119] extend adversarial patch
experimentally shows it superior to the classification output;
attack to object detector by simply attack the classification
NPS loss and TV loss are also used to ensure the printability
output of the detector. Although they demonstrated that the
and naturalness of the adversarial patch. To improve the
adversarial patch could successfully implement the targeted
physical robustness of the adversarial patch, the author adopted
attack and non-target attack on to object detector, the validity
a series of random transformations to the optimization process.
of the physical adversarial attack is not verified.
Experiment results demonstrated that the generated adversarial
3) RP2+: Following up the physical adversarial against
patch could hide the person in front of the surveillance camera
image recognition model [46], Eykholt et al. [50] extended
(based on YOLOv2) in most cases. However, there also exists
the RP2 algorithm to attack object detector. Specifically, they
the failure case when rotating the rotation in a large margin.
modify the adversarial loss for adapting to attack object de-
Zhao et al. [85] systemically investigated the adversarial
tector under two strategies creation and disappearance attack.
patch attack against two detectors (i.e., YOLOv3 and Faster
According to the observation that the detector is more tends
RCNN) in both digital and physical environments. Specifically,
to focus more on contextual areas for prediction, they take
the author first exploited the intermediate features to enhance
the object’s position and size into account to constrain the
the adversarial examples. To enhance the physical adversarial
adversarial patch, which is realized by performing rotation (in
attack, the author constructed a physical dataset by collecting
the Z plane) and position (in the X-Y plane). Additionally,
the real-world background and traffic sign image, respectively;
they find the L∞ lead to a very pixelated perturbation that
then, the traffic sign image is embedded into the background
hurts the attack performance, and then they adopt the total
image. The author also adopted the EOT to guarantee the
variation norm (TV loss [52]) instead of L∞ to address this
robustness of the adversarial patch. The author conducted
issue. The final optimization objective is expressed as follows.
the physical attack by placing the camera device inside the
argmin λ · T V (Mx · δ) + N P S car and toward the printed adversarial patch. They evaluated
δ (16) different distances between the car and the adversarial patch
+Exi ∼X V J(f (xi + Ti (Mx · δ)), y), by controlling the car’s speed (i.e., 6km/h ∼ 30km/h), the
where J(·, y) is the adversarial loss function devised for the attack success rate over 72%.
object detector, which considers the classification output. In Unlike generating the adversarial patch to overlap the object
physical attacks under indoor and outdoor conditions, the for misclassified or misdetection, Lee et al. [86] introduced an
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
approach to craft the adversarial patch that can place anywhere
(even far from the object) in the image, which can suppress
all the detected objects. Specifically, the author designed the
adversarial loss against the YOLO serial detectors and adopted
the EOT (affine transformation and brightness on HSV color
space) to improve the physical robustness. The PGD [12] is
adopted the optimize the adversarial patch. In physical attacks,
the author printed out the adversarial patch and recorded
the video under natural lighting conditions. The YOLOv3 is
adopted to evaluate the effect of physical attacks. Experiment
results show that the patch is invariant to location. However,
when placing the adversarial patch away from the object, the
size of the patches needs to be enlarged.
4) UPC: Previous works mostly craft the instance pertur-
bations for rigid or planar objects (e.g., traffic sign), ignoring
the non-rigid or non-planar objects (e.g., clothes). To address
this issue, Huang et al. [48] proposed to craft the universal
physical adversarial camouflage (UPC) for the non-rigid object
(i.e., person). Specifically, the author used the nature image
as the initialization of the adversarial patch for the purpose
of visual inconspicuous. Moreover, a set of transformations
is performed on the adversarial patch to mimic deformable
properties. Then, the author devised specific two-stage attack
procedures against Faster RCNN: the RPN attack and the
classifier and regressor attack, which are implemented by the
following loss function.
Lrpn =Epi ∼P (D(si , st ) + si ||d~i − ∇d~i ||1 ),
Lcls =Epi ∼P̂ C(p)y + Epi ∼P ? L(C(p), y),
(17)
X
Lreg = ~ 2,
||R(p) − ∇d||
pi ∼P ?
where si and d~i are the confidence score and coordinates
of i-th bounding box; st is the target score, where s1 and
s0 represent the background and foreground. ∇d~i is the
predefined vector that guides the optimization direction. C and
R are the prediction output of the classifier and the regressor.
P is the output proposal, P̂ is the top-k proposal filtered by
confidence score and P ? is the proposal that can be detected
as true label y. d~ denotes the distortion offset. Additionally, the
TV loss is also adopted to produce more natural patterns. In
physical attacks, the author printed the adversarial patterns and
stuck them over the car (i.e., non-plane objects) and captured
the picture from different distances (8 ∼ 12 m) and angles
(−45◦ ∼ 45◦ ). Experiment results show that the adversarial
camouflage could reduce the detector’s performance by a large
margin.
5) LPA Attack: Unlike the previous patch-based physical
attacks [45], Yang et al. [87] proposed to generate the adver-
sarial license plate to fool the SSD. Specifically, the author
devised a mask to guide the perturbation region, optimized by
the C&W adversarial loss and color regularization consisting
of NPS and TV loss to ensure adversarially and eliminate the
color discrepancy between the digital and physical worlds. In
optimization, EOT is used to enhance physical robustness. In
physical attacks, the author created the adversarial license plate
and placed it on the real car. Experiment results suggested
15
that the detection performance on captured images average
degraded 76.9% in indoor and outdoor conditions.
6) TranslucentPatch: Unlike crafting the adversarial patch
and pastes on the object’s surface, Zolfi et al. [88] proposed a
novel adversarial attack that crafts the adversarial patch, which
was stuck on the camera lens. To avoid the camera lens being
overlapped by the adversarial patch, the author took the im-
age’s alpha channel into account during the optimization. The
author implemented the targeted attack and simultaneously
maintained the non-attacked objects were not to be affected,
which are implemented by the Equation (18) and (19).
Ltarget conf = P r(objectness) × P r(targetclass), (18)
1 X
Luntarget conf =
M
cls ∈ image
(19)
cls 6= target
|conf (cls, clean) − conf (cls, patch)|,
where the P r(objectness) and P r(class) represent the ob-
jectness and classification of detector, respectively. Addition-
ally, the author also takes the Intersection over Union (IOU)
as the adversarial loss
gt
LIoU = IOUpredcit (target). (20)
The predicted bounding box changed by minimizing the LIoU .
The author also adopted the NPS to ensure the color of the
printed adversarial patches. The author conducts the physical
attack by first printing out the adversarial patch on transparent
paper, then placing it on the camera’s lens, then capturing the
video. The physical attack evaluated on YOLOv2/5 and Faster
RCNN achieves over the average fooling rate of 35.48%.
7) SwitchAttack: Recently, Shapira et al. [89] developed
a targeted attack method to generate the adversarial patch
that is pasted on the car hood to attack object detectors
(i.e., YOLOv3 and Faster RCNN) in a more realistic monitor
scenario. Specifically, the author devised a tailored projection
method to adaptively adjust the position and shape of the ad-
versarial patch in terms of the camera orientation. To performs
the targeted attack, the author considers all candidates that
surpass the specific threshold before the NMS component to
ensure the relevant candidates can be classified as the target
label. Moreover, TV loss is adopted to improve the physically
deployable of the adversarial patch. In physical attacks, the
author stuck the printed patch on the toy car, achieving an
attack success rate of 95.9% on recaptured images.
8) ScreenAttack: The first step of current patch-based phys-
ical attacks is to print out the adversarial patch, which is
static in practice, and ignore the constantly changing character
of the physical world, which may result in a failed attack.
To address this challenge, Hoory et al. [90] proposed a
dynamic adversarial patch for evading object detection models
by displaying the adversarial patch with a digital screen (see
Figure 11). The author adopted the loss function as the same
to [47] to train the adversarial patch. Additionally, the author
pointed out that the adversarial patch crafted by loss function
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
[47] is easily misdetected to the semantically related category,
which makes it inconsistent with background objects. To this
end, the author considered the semantically-related class (e.g.,
bus or truck) of the original class (i.e., car) as the target and
devised the following loss function
X adversarial perturbation. To further enhance the performance
J(δ, xadv , C) = α · T V (δ) + L(f (xadv ), yi ), (21)
yi ∈C
where C is the set of semantically-related labels used to avoid
being detected as car-related classes. Furthermore, the author
split the train set into multi subsets and trained an adversarial
patch for each subset. In physical attacks, the author placed
a digital screen on the side and rear of the car, where the
adversarial patch is chosen from the patch subsets to dynamic
display in terms of the changing environmental conditions.
Evaluation results on YOLOv2 suggested that 90% video
frames with the adversarial perturbed screen can not detect
the target object (i.e., car).
Fig. 11. Dynamic attack by display the adversarial patch on the screen. [90]
Recently, the adversarial patch has been applied to attack the
face detector (i.e., FPN [120]) in the digital domain ( [121])
by sticking on the person’s forehead to conduct the adversarial
attack.
B. Wearable adversarial perturbation
Unlike devising the simple plane (non-rigid) adversarial
perturbation, the non-rigid object show more difficult as that
needs to take the deformable of the adversarial patch into
account in physical deployable. Wearable adversarial perturba-
tion approaches [91], [92], [92], [93] were designed to address
that issue. Figure 12 illustrates the related wearable patch-
based adversarial attack.
[91] [82] [92] [93] [95] [94] [38]
Fig. 12. Visualization examples of various wearable adversarial patches.
Yang et al. [91] extended EOT from 2D space to 3D
space by building up a pinhole camera model to mimic the
patch’s transformation in the physical world. In optimization,
the author adopted the C&W-based adversarial loss, TV loss,
and Euclidean distance between the clean image and the
adversarial image with patch to optimize the adversarial patch.
In physical attacks, the author holds the laptop where the
screen displays the adversarial patch. Experiment results on the
captured image show that the YOLO’s detection performance
degraded from 100% to 28%.
16
Xu et al. [92] proposed an adversarial T-shirt attack to avoid
the detection of the single object detector (i.e., person) in the
physical world. The generated adversarial pattern is attached
to the surface of the T-shirt. To mimic the cloth deformation
in the physical world, the author proposed to apply the
Thin Plate Spline Mapping (TPS) transformation over the
of the adversarial attack, the author adopted the following
three approaches: 1) approximate the cloth’s deformation with
TPS; 2) approximate the color discrepancy between digital
and physical space with a quadratic polynomial regression.
3) enhance the robustness of the adversarial perturbation
with EOT. By performing the above operations, the T-shirt
stuck with the adversarial patch degrades the person detector
significantly under indoor and outdoor physical conditions.
Concurrent to [92], Wu et al. [93] proposed to devise an
adversarial patch to implement the disappear attack. To this
end, the author devised the objectness disappear loss, which
is expressed as follows
X 2
Lobj = Et∼T max {Si (A(x, δ, t)) + 1, 0} , (22)
i
where A(x, δ, t) is the patch apply function, which pastes
the adversarial patch δ on the image with the transformation
process t; Si indexes the objectness score of i-th proposal.
By minimizing this loss function, the adversarial examples
with the devised patch could suppress the positive scores.
Additionally, the TV loss is adopted to ensure the visual effect
of the adversarial patch. In physical attacks, the author treated
the printed patch as a sticker of the clothes. Experiment results
suggest that the adversarial patch in the physical world could
deceive the YOLOv2 and Faster RCNN. Moreover, the author
empirically finds that the TPS would detriment the adversarial
performance.
Tan et al. [94] pointed out the existing adversarial wearable
patches are conspicuous to humans. Thus, the author proposed
two-stage strategies to optimize the legitimate adversarial
patch that can evade both human eyes and detection models
in the physical world. In the first stage, the author began
with a random cartoon image and optimized an adversarial
patch that could deceive the detector. In the second stage,
the author adopted the clean cartoon image and the optimized
patch crafted in the first stage to constrain the adversarial patch
to evade human attention. The author adopted the TV loss and
the Euclidean distance between the adversarial patch and the
cartoon image to ensure visually natural to human observers.
Moreover, NPS loss is used to constrain the patch color inside
the printable colors. The author conducted the physical attack
by attaching the printed adversarial patch to the white T-shirts.
The case study shows the effectiveness of their adversarial
patch against YOLOv2 in the physical attack.
Concurrently to [94], Hu et al. [95] proposed to exploit the
learned image manifold of a pre-trained GAN (e.g., BigGAN
and StyleGAN) to guide the adversarial patch generation.
Rather than directly optimizing the adversarial patch from
scratch, the author treats the image sample sampling from
the generator as the adversarial patch. Then the patch is
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
applied to the target object inside the image to constructing
the adversarial examples. The TV loss and the following
adversarial loss are adopted to optimize the adversarial patch
N
1 X j j
L= max[fobj (xadvi ) · fcls (xadvi )],
N i=1 j
where the xadvi is the i-th image in a batch with size
j j
N. fcls , fobj represent the class probability and objectness
probability, respectively. In physical attacks under indoor and
outdoor conditions, the author recorded one person wearing
the adversarial shirt side-by-side with another person wearing
an ordinary shirt. Experiment results show that the phys-
ically recaptured image could degrade the detection recall
of YOLOv4tiny by approximately 23.80% and 43.14% (for
indoor and outdoor, respectively). Moreover, they exhaustly
investigate the influence of different transformations, patch
sizes, and target classes on attack performance.
Hu et al. [96] got inspiration from cloth making and
proposed to treat the adversarial patch as the whole cloth to
be cut. To generate a naturalistic patch, the author utilized the
generative model to generate the adversarial patch and then
overlap them with the object. To simulate the physical defor-
mation of the cloth, the author applied the TPS transformation
over the adversarial patch. TV loss is adopted to ensure the
smoothness of the patch’s pattern. They conduct the physical
experiment by painting the adversarial patch over the cloth and
then making the clothes. The adversary who wore the crafted
adversarial clothes can bypass the detector with the average
attack success rate of 80.75% against different detectors (i.e.,
YOLOv2/3, Faster RCNN, and Mask RCNN) under different
distances and view angles (range from 0◦ to 180◦ ). Figure 13
describe the adversarial patch and the corresponding clothes.
Fig. 13. Adversarial patch (left) v.s. adversarial clothes (right). [96]
C. Projector’s Projection
Rather than generating the adversarial patch directly, Lovi-
sotto et al. [97] presented a novel adversarial attack by mod-
ulating the projector’s parameters. The author first collected
the projectable colors as following step: 1) collect the target
image of the target object as the projection surface S; 2) select
a color cp = [r, g, b], and the color Pcp over the projection
surface, resulting in the output Ocp . Finally, repeat the above
two steps until collecting enough data. The author takes the
camera noise and projector’s work mechanism into account to
collect the realistic color as possible. After that, the author
fitted a projection model as follows
X
LP = argmin ||P(cs , cp ) − c(s,p) ||1 , (24)
o
w
∀cs ,cp
17
(s,p)
where P is the projection model, cs , cp , co is the training
data triple, consists of projecting cp on pixels of color cs , and
(s,p)
the output co ; w is the parameters of the projection model.
To optimize the adversarial examples, the author combined the
EOT and treated the objectness and classification output of
(23)
the detector as the adversarial loss. The author conducted the
physical attack by placing the projector away from the target
object from 1 to 12 meters and viewing angles −30◦ ∼ 30◦ ,
achieving the success rate 100% for the traffic sign classifi-
cation model and 77% for object detectors (i.e., Mask RCNN
and YOLOv3).
D. Camouflage-based physical adversarial attack
The works discussed above are mainly focused on gen-
erating the adversarial patch on the 2D image, where each
pixel can be modified independently. Recently, researchers
have increasingly paid attention to more realistic attacks in 3D
space, developing adversarial camouflage-based attacks that
focus on modifying the appearance (i.e., shape or texture) of
the 3D object.
1) Shape of 3D object: Zeng et al. [98] first proposed to
generate the adversarial examples against 3D shape classifica-
tion and a visual question answer (VQA) system. Specifically,
they crafted the adversarial example by adopting the neural
renderer technique, which allows them to perform the 3D
transformation to better approximate real-world environments.
Concurrent to Zeng [98], Xiao et al. [122] proposed to
generate an adversarial object by modifying the mesh of a 3D
object, namely MeshAdv. The adversarial mesh is optimized
on the total loss consisting of classification loss, objectness
loss, and perceptual loss. Moreover, the author extends the
TV loss from pixel-wise in the 2D image to the vertex in the
3D image. However, the methods of the above method limited
their utilization, which made them fail to conduct the physical
attack.
2) CAMOU: Unlike the works [98], [122] optimize the ob-
ject mesh, Zhang et al. [99] proposed to optimize the texture of
the 3D object. The author presented a clone network to mimic
the entire processing containing the adversarial texture render
and detector prediction. Then apply the white-box attack on
the clone network to optimize the adversarial texture. Although
the camouflaged vehicle achieved good attack performance on
Mask RCNN, the optimized texture is a mosaic-like pattern,
which is conspicuous to the human observer.
3) UPC: Huang et al. [48] proposed to optimize the
adversarial texture from the patch seed and stick the adver-
sarial patch over the partial vehicle’s surface to obtain well
appearance. It is worth noting that the author printed out the
adversarial texture and stuck it on the real car to experiment.
4) ER: Rather than construct the adversarial patch under
the white-box setting, Wu et al. [100] considered a more
challenging black-box attack. The author proposed to utilize
the genetic algorithm to optimize the adversarial texture. To
reduce the optimization variable, the author optimizes small-
size adversarial texture (64 × 64), then enlarges or repeats
(ER) to a large scale (2048 × 2048). The adversarial texture is
rendered wrapped over the vehicle in the simulator environ-
ment via Carla [123] PythonAPI, then recorded the adversarial
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
examples from the simulator environment and used to query
the detector (i.e., Light head RCNN [124]). They show the
adversarial texture generated by the black-box attack could
significantly reduce the performance (the magnitude of 52%)
of the detector in the simulator environment while ignore
verify the physical attack.
5) DAS: Wang et al. [30] pointed out that the adversar-
ial camouflage generated by the previous works [99], [100]
failed to consider the model’s attention, resulting inferior
transferability. To this end, the author proposed simultaneously
suppressing the model and human attention. To suppress the
model’s attention, the author proposed dispersing the intensity
attention map by disconnecting the connected graph generated
from the attention map. To suppress human attention, the
author adopted the seed content patch as initialization and
encouraged the adversarial texture to remain similar to the
seed content. Moreover, the author optimizes the specific part
faces of the 3D model as the textures via neural renderer [125].
To optimize the adversarial texture, the author constructed a
dataset sampled from the Carla simulator at different distances
and angles. The author conducts the physical attack by printing
out the camouflaged rendered car on paper and then cropping
the camouflage texture and sticking it on the toy car. Experi-
ment results suggested that the average performance reduction
of four detectors (i.e., YOLOv5, SDD, Faster RCNN, and
Mask RCNN) is 26.05%.
6) FCA: Recently, Wang et al. [33] proposed to craft
the full-coverage adversarial camouflage texture to overcome
more complex environment conditions (e.g., multi-view and
occlusion), which are less explored in the current patch-like
[47] and partial camouflage work [30], [48]. To maintain the
effectiveness of the small ratio of adversarial camouflaged
vehicles in the image, the author used multi-scale IOU loss to
constrain the adversarial texture. Finally, the author combined
the TV loss and adversarial loss (i.e., including IOU, classifi-
cation, and objections) to optimize the adversarial camouflage
texture. They adopt a similar physical attack process (including
datasets and detector) with [30], and the experiment shows
their method’s effectiveness under complex environments,
degrading the average reduction of the detector performance
of 53.99% in physical attacks.
7) CAC: Unlike [33] optimize the full coverage faces of
the 3D model that encountered the difficult issue of hard
implementation, Duan et al. [34] proposed to optimize the 2D
texture of the 3D model directly. They proposed to optimize
the texture by minimizing all classification output of the RPN
module at the first stage of Faster RCNN. Although they
adopted various physical settings (e.g., angles, brightness,
etc.), the author trained the texture on the image with pure-
color background. In physical attacks, the author print out the
entire vehicle model with the 3D printer, and the experiment
demonstrates their method’s effectiveness in the physical en-
vironment under 360◦ free viewpoint settings.
8) DTA: Suryanto et al. [35] pointed out the previous works
[30], [33] fail to consider more specific physical environmental
conditions, e.g., shadow. To address the above issue, the author
used a network to approximate the shadowing effect. Rather
than adopt the neural renderer to optimize the adversarial
18
UPC [48] Wu [100]
DAS [30] FCA [33]
Random CAMOU [99] CAC [34] DTA [35]
Fig. 14. Visual appearance of various camouflage texture rendered vehicle.
texture, the author optimizes the 2D image as the texture but
transforms them with the same camera matrix as the vehicle.
In physical attacks, the author printed out the camouflaged 3D
object with a 3D printer and captured the photo every 45◦ .
Experiment results suggested that the average performance
reduction of two detectors (i.e., EfficientDetD0 [126] and
YOLOv4) model is 47.5%.
In summary, the camouflage-based adversarial texture has
attracted increasing attention in recent years because it can
better mimic physical transformations (e.g., shadowing and
brightness). For example, recently, Byun et al. [127] proposed
to adopt the neural renderer as the data augmentation technique
to boost the robustness of adversarial examples. The discussed
camouflaged attacks mainly focus on generating the adver-
sarial camouflage texture, while the loss function, especially
adversarial loss, has been less explored. Additionally, these
works conducted the physical attack by printing a small-size
car model rather than the real car. We argue it is far away from
a realistic attack on the vehicle. Alcorn et al. [128] argued that
the reason for the vulnerability of detectors might be attributed
to these simulated images being strange to the detector. In
other words, the detector was not trained on such simulated
data, resulting in bad generalization. Moreover, there are many
issues to be solved, including but not limited to small-size
adversarial objects and the complex physical environment
condition (e.g., occlusion and lighting) in the real world.
E. Against the infrared detectors
[31]
[32]
Fig. 15. Adversarial against infrared thermal imaging detector.
The existing physical adversarial attack mainly focused on
the RGB image in visible light, while visible light has its
limitations in dark environments (e.g., darkness); for example,
the image content taken in the evening is hardly identified.
However, infrared thermal imaging has its advantage because
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
it is free from lighting changes, enabling them adopted widely
in the real world.
Zhu et al. [31] proposed a novel adversarial method to attack
the infrared thermal imaging detector. The author devised
a board with multi bulbs, where the positions of bulbs are
the optimization variables. To mimic the shining of the bulb,
the author applied the gaussian function on the pixel of the
bulb’s position. Finally, the author treated the combination of
objectness output of detector and TV loss as their loss function
to optimize the adversarial patch. The author conducted the
physical attack by placing the bulb in the optimized positions
and photoed the people who held the board. Experiment results
show that the adversarial bulb board degrades the detector by
34.48%.
Recently, the author pointed out that [31] may be failed
in multi-view environments and proposed to construct the
adversarial clothes covered with adversarial texture made by
aerogel [32]. More specifically, the author adopted a similar
idea with [96] to optimize the adversarial patch image. To
simplify the physical implementation, the author optimized the
QR code-like adversarial texture, which allows the author only
required to optimize the generation parameters of the QR code
texture. The generated QR code texture is tiled to a large shape,
and then the actual adversarial patch is randomly cropped
from the tiled image and then pasted onto the target object
in the image. The TPS and various transformations are used
to improve the robustness of the adversarial patch. The author
made the clothes by attaching the black block to the aerogel
according to the optimized QR code texture. The participant
who wore the adversarial patch could successfully bypass
the detector (i.e., YOLOv3), where the detection performance
degraded by 64.6%.
F. Against Aerial detection
Unmanned aerial surveillance has gained increasing atten-
tion with the development of drone techniques and object
detection. Correspondingly, the adversarial attack against un-
manned aerial surveillance aroused increasing attention in
the military scenario. The conventional technique against
unmanned aerial surveillance is to use the camouflage net,
while a recent study shows that a partial imagery patch could
deceive the unmanned aerial surveillance.
Random patch Adversarial patch
Fig. 16. Visualization result of different patch. [129].
Den Hollander et al. [129] assumed unmanned aerial
surveillance is the YOLOv2 trained on the aerial imagery
dataset. To attack the object detector, the author combined the
common loss consisting of the adversarial loss, NPS loss, and
the objectness loss and proposed a novel colorfulness metric
19
as a saliency loss to train the adversarial patch. The saliency
loss is represented as follows
q q
Lsal = 2 + σ 2 + 0.3 ∗
σrg µ2rg + µ2yb
yb
(25)
rg = R − G, yb = 0.5 ∗ (R + G) − B,
where µ and σ are the averages, and the standard deviation
of the auxiliary variables, R, G, and B denote the patch’s
color channel values. The author investigated the impact
of the patch’s size, position, number, and saliency on the
adversarial performance. Experiment results demonstrate that
the optimized patch could reduce the detector performance
significantly (i.e., 47%).
Recently, Du et al. [101] implement the physical adversarial
attack against the aerial imagery detection. Considering the re-
alistic scenario, the author designed two types (see Figure 17)
of adversarial patches to accommodate the different scenarios.
Type ON refers to the adversary placing the adversarial patch
on the top of the car, which is suitable for dynamic scenarios
(i.e., the car is driving). By contrast, Type OFF refers to the
adversary placing the adversarial patch around the car, which is
suitable for stationary scenarios (e.g., parking lot). The author
adopted objectness, NPS, and TV loss to train the adversarial
patch. The author conducted the physical attack by printing
out the adversarial patch and placing them around or near the
target objects under different lighting conditions. Experiment
results demonstrated that the printed-out adversarial patch
could significantly reduce objectness score (25% to 85%).
Type ON Type OFF
Fig. 17. Patches designs [101].
Apart from two adversarial patch attacks against the object
detector on the aerial imagery dataset, there are a number of
attempts to attack the remote sensing image recognition, and
detection [130]–[132].
G. Other adversarial attacks against object detection
Although physical attacks consider the more realistic con-
ditions, the basic procedure behind physical attacks is similar
to digital attacks, i.e., the first step of the physical adversarial
attack is to construct the adversarial perturbation in the digital
world. Thus, some digital attacks may inspire physical attacks.
Wang et al. [133] proposed a dense adversarial generation
(DAG) attack, which simultaneously attacks the classification,
objectness, and the classification and regress loss of the
RPN module. Chow et al. [134] systemically investigate the
adversarial objectness attack against the common detectors
(i.e., YOLOv3, SSD, and Faster RCNN) on three different
benchmark datasets, the devised adversarial patch could paste
on the image or add into the image. Wang et al. [135] proposed
a creative attack by disturbing the non-maximum suppression
(NMS) module of the detector, which resulted in enormous
wrong results on the generated adversarial examples. Liao et
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
al. [136] showed that there is no need to generate global
perturbation for the whole image, the author exploited the
high-level semantic information to generate local perturbation
for detectors. To improve the naturalness of the adversarial
patch, Pavlitskaya et al. [36] extend the existing GAN-based
approaches [95] by attacking all object that appears in the
image to generate inconspicuous patches, and then assessed
the trade-off between attack performance and naturalness.
SAA [137] DPatch [138] RPAttack [139]
HideAttack [138] HideAttack [138]
Fig. 18. Visualization of different sparse attack against the object detector.
Unlike searching the global perturbation for the whole
image, the research has attempted to implement the sparse
attack by perturbing a few numbers of the image pixel,
which makes them suitable for extending to physical attacks.
Although the sparse adversarial attack has been investigated
in image recognition systems [140]–[144], their application
on object detection is unexplored. Figure 18 illustrated the
successfully sparse adversarial attack in the digital world.
To perform the sparse adversarial attack, Bao et al. [137]
generated the adversarial patch by simultaneously considering
the position, shape, and size of the adversarial patch into
optimization. Zhao et al. [145] proposed two adversarial patch
generation algorithms: exploit the heatmap to guide the patch
application and consensus-based algorithm (i.e., one of the
model ensemble strategies). The proposed algorithm won
seventh place in the Alibaba Tianchi adversarial challenge
object detection competition. Wu et al. [138] proposed a
diffused patch attack to optimize the adversarial line embedded
in the object’s center. The proposed attack won second place
in the Tianchi competition. Li et al. [146] extend the universal
adversarial perturbation [147] from image recognition tasks to
object detection tasks and proposed a universal dense object
suppression (U-DOS) algorithm to optimize the universal
adversarial perturbation to deceive the detector on most input
images. To probe the model’s blind spots, Zhu et al. [148]
came up with a novel approach that simultaneously models
the shape and the pattern of the adversarial patch; they can
generate multi patches with different shapes for a specific
image. Huang et al. [139] proposed to generate the adversarial
patch and gradually remove the inconsequential perturbation
in the crafted patch. In addition, the author devised a weighted
strategy to stabilize the model ensemble, avoiding the coun-
termeasure among different detectors. The experiment result
shows that perturbing a few numbers of pixels could reduce
the detector significantly (obtaining 100% missed detection
20
rate for both YOLOv4 and Faster RCNN).
H. Attack Semantic Segmentation
Semantic segmentation is similar to the object detection task
but needs fine-grind classification for every pixel in the image.
However, physical attacks against semantic segmentation are
less explored, which will be discussed as follow.
Nesti et al. [102] proposed to optimized a scene-specific
billboard patch to attack the semantic segmentation models.
The author exploits the Carla simulator [123] to simulate a
more realistic environment of the real world. Rather than adopt
the EOT in the 2D image space, the author exploited various
physical transformations in the 3D dimension provided by
Carla. More specifically, the author first applied the projective
transformation to precisely paste the patch onto the 2D attack-
able surface with the extracted 3D rotation matrix. The author
devised the following loss function to optimize the patch.
X X
LM = LCE (fi (xadv ), yi ), LM̄ = LCE (fi (xadv ), yi ),
r∈Ω r6∈Ω
(26)
where LM describes the cumulative cross entropy (CE) for
those pixels that have been misclassified with respect to the
ground truth y, denoted as Ω; while LM̄ refers to all the others.
The author printed out the billboard patch as a 1 × 2 meter
poster, which could successfully hide the target object. Figure
19 illustrates the physical billboard patch.
Fig. 19. Visualization of Random patch (left) and optimized patch (right).
[102]
Unlike the image recognition and object detection task, the
research on the physical adversarial attack against the semantic
segmentation task lacks enough attention. The possible reason
is the task similarity between object detection and semantic
segmentation. Additionally, semantic segmentation models are
commonly deployed in autonomous driving, and the physical
adversarial attack against the autonomous driving system has
gained enormous attention [149]–[151], which is beyond the
discussion of this paper. Such reason may result in a few
numbers of literature investigating the physical adversarial
attack against semantic segmentation.
Nonetheless, several attempts have explored the digital
attack against semantic segmentation. Hendrik Metzen et al.
[152] proposed universal adversarial perturbation to deceive
the semantic segmentation on most images. Unlike to [152],
Nakka et al. [153] pointed out there is no need to perturb the
whole image to realize the attack and proposed to optimize the
adversarial patch applied to the object to attack the semantic
segmentation. Arnab et al. [154] systematically investigated
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
the adversarial robustness of the semantic segmentation with
respect to various attack (e.g., FGSM [10], PGD [12]).
Additionally, physical adversarial attacks have been recently
applied to various fields, such as depth estimation [103] and
object tracking [104], [105].
VI. D ISCUSSION AND F UTURE W ORK
Although physical adversarial attacks impose potential risks
for existing deployed DNN-based systems, the issue remains
to be solved. In this section, from the perspective of the attack
pipeline (i.e., input transformation, algorithm design, and
evaluation), we will summarize the common techniques used
to develop physical attacks and then discuss the promising
methods used to boost further the performance of physical at-
tacks. Finally, we discuss the potentially beneficial application
of the physical deployable adversarial perturbation.
A. Input transformation
The essential of input transformation is the expectation
maximization of the objective function over the inputs that
convert on various transformation operations (e.g., rotation,
affine transform, brightness adjust). In adversarial attacks,
the transformation is exerted on the adversarial examples
to make them robust to such transformation or boost their
transferability. Thus, input transformation is a simple but
effective way to improve adversarial attacks’ performance
both in the digital and physical world. However, the complex
environmental condition may curb the effectiveness of such
transformations. To address the issue, the digital and the cor-
responding physical recaptured image pairs are used to boost
the physical robustness of adversarial perturbation. Another
solution is to use a network to model the discrepancy between
the digital and physical worlds.
To better mimic the physical transformation in the real
world, given the stronger learning capability of DNN, one
approach is to exploit a network to learn the various physical
transformation, such as shadow, brightness, rotation, satura-
tion, and so on. For example, one can use a network to learn
the explicit physical transformation from video sequences.
Thus, collecting high-quality training data is significant to the
network’s performance.
B. Attack algorithm design
Although a line of physical attacks has been proposed for
different tasks and achieved certain success, many problems
still exist, which will be discussed as follows.
1) Adversarial patch application: Adversarial patch appli-
cation refers to how to paste the adversarial perturbation on
the host image/object, which is crucial for adversarial patch
attacks. However, most existing works have used the mask to
guide the application of the adversarial patch, which curbs the
performance of the attacks. The reason may include two-fold:
on one side, only a specific area of the image is crucial for the
model decisions, and modifying unspecific areas may have a
countereffect; On another side, a large block of perturbation
is conspicuous to the human observer, hurting its stealthiness.
21
Based on the aforementioned discussion, one promising
approach is to adaptive adjust the mask’s shape, such as using
a network to automatically learn the best mask or exploit the
geometry algorithm to optimize the optimal mask.
2) Universal adversarial perturbation via black-box attack:
Many existing physical attacks belong to white-box attacks,
and the perturbation is defaulted to be universal, which means
it only requires optimizing one perturbation to fool the whole
dataset. Despite their success, the white-box setting is not
practical in practice. Regarding black-box attacks, there are
plenty of works [16], [155]–[157] have been proposed for
attacking the target model in the digital world. Moreover, these
works are designed to generate perturbation for each input
image, which limits their application in practice. In surveyed
works, only one work was proposed to optimize the universal
adversarial perturbation against the image recognition model
in digital work [158].
Therefore, developing physically deployable universal
black-box attacks is more realistic in practice but more dif-
ficult. Some algorithms can solve the above problem, such
as genetic algorithm, differential evolution, particle swarm
optimization, and random search. However, optimizing the
perturbation revolves to solve a high-dimension optimization
problem, which significantly confines the efficiency and ef-
fectiveness of the attack. Thus, reducing the optimization
dimension is crucial for developing the physical deployable
black-box attack. Moreover, other issues referring to black-
box may need to be considered, such as time-consuming and
query efficient.
3) Transferability: Transferability is one of the significant
characteristics of adversarial perturbation, which refers to the
adversarial perturbation generated for the known model and
can also be used to attack the unknown model. In realistic
physical attacks, the adversary may not know what the DNN
deployed in the system, which makes the transferability of
adversarial perturbation essential for physical attack perfor-
mance. However, the existing physical attacks mainly focus on
the robustness of physical attacks and attack performance on
specific known models, making the transferability of physical
adversarial attacks less explored.
There are enormous works attempts to improve the trans-
ferability of digital attacks, including but not limited to in-
put transformation, gradient calibration, feature-level attack,
model ensemble, and generative model. These techniques
could be combined with physical attacks to boost their trans-
ferability.
4) Simultaneous attack multitask: Most current physical
attacks focus on attacking specific tasks, such as image
recognition and object detection. However, in the real world,
the attacker cannot get knowledge about the target victim
system, such as whether the system is equipped with the
image recognition model or object detection model. Therefore,
one promising direction to address the above problem is to
take multi-task into account during the optimization simulta-
neously.
Recently, the vision transformer (aka., ViT) provided a novel
general framework for vision tasks, exhibiting competitive
performance to CNN-based framework. With the increasing
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
application of Vit, physical adversarial attacks against the ViT
should arouse the researcher’s attention.
5) Robustness of physical attacks: The main problem faced
by physical adversarial attacks is the complex physical envi-
ronments, including brightness, lighting, shadow, deformation,
distance, occlusion, and the system noise introduced by the
imaging sensor (i.e., camera). The existing approaches en-
counter the following drawbacks when applied to physical
attacks. First, they generally resit some of these conditions
and hard take all underlying physical environment factors into
account. Second, they cannot cover some physical conditions,
such as partial shadow or occlusion of the target object.
Third, the used transformation (e.g., rotation or brightness
change) modifies the whole pixel of the image instead of
the target object, which is inconsistent with real physical
deployment. Finally, there are no works to take the dynamic
changing of the size of the target object into account, which is
crucial in the real-world scenario as the perturbed object will
move. Therefore, constructing a general and robust physical
adversarial attack is an open problem for future research.
Two promising techniques may be can used to solve the
above issues. The first one is to utilize the technique from the
computer graphic, such as the physical renderer, a computer
graphics approach that seeks to render images in a way that
models the flow of light in the real world. The second one
is to utilize emerging technologies, i.e., neural radiance fields
(NeRF), a method for synthesis for novel views of complex
scenes. The abovementioned approaches can be integrated into
optimizing adversarial attacks to mimic complex real-world
conditions.
6) Stealthiness: Most existing successful physical adversar-
ial attacks pursue higher and more robust attack performance
with the sacrifice of perceptible. One reason is the mode of
projecting the perturbation to the sphere of L∞ with a radius
of a specific magnitude in digital attacks may be unsuitable
for physical attacks as the slight perturbation may be distorted
caused by the device noise or environmental factors, making
the attack invalid. Moreover, visually conspicuous adversarial
perturbation patterns easily observe by humans. Thus, as
we cannot diminish the perturbation magnitude, making the
adversarial patterns more natural may be a promising work.
C. Evaluation
1) Evaluation benchmark dataset: Although most physical
attack methods were proposed, they are devised for different
datasets, resulting in hardly evaluating different methods on
one uniform dataset. Thus, it is urgent to develop a public
dataset for evaluating the effectiveness of the attack methods.
On the other hand, there is no unified evaluation process
and criterion for physical attacks, which makes it hard to
reproduce the result reported in the publications. However,
the real environment is complex and hard to reproduce as the
changing weather and light condition. Recently, some research
has attempted to use the simulator to develop adversarial
attacks, which gives a promising direction to develop an
environment for evaluating physical attacks as the simulator
can provide reproducibility and definite environments by fixing
22
the scene and parameters (e.g., weather and light conditions).
For example, one can develop a physical testing environment
using an open source simulator (e.g., Carla [159] or AirSim
[160]), then provide the physical testing interface, allowing
the attacker to call the testing procedure with their optimized
adversarial perturbation and report the attack results.
2) Uniform physical test criterion: Most physical attacks
conduct physical experiments under stationary conditions,
which means that the adversary takes photos of the adversarial
perturbation disturbed object at a specific position and then
evaluates the attack performance of the captured image. How-
ever, the target object moves in and out of the viewfinder of
the system’s sensor device in the actual physical environment,
meaning that the ratio of the perturbed object is dynamically
changing with respect to the fixed viewfinder. In the dynam-
ically changing process, many factors caused by the back-
ground environment would impact the attack performance. The
stationary test cannot include such a complex scenario. To
this end, the dynamic physical test may better represent the
performance of the attack method in the real world. Therefore,
a complete criterion of the physical test process is urgent to
boost the development of physical adversarial attacks.
3) Applications: The adversarial attack is a double-blade
sword. On the one side, adversarial attacks would lead the
DNN-based system to make mistakes, resulting in potential
security risks. On the other side, adversarial attacks also
have their benefits side, such as 1) the adversarial perturbed
physical adversarial example could be used as the training
data to boost the adversarial robustness of DNN further; 2)
adversarial perturbation can used to help the DNN system
remain stable in complex environmental conditions [161],
[162]. Therefore, potential applications exploiting adversarial
perturbation to boost the performance of DNN in the real
world is an interesting research direction.
VII. C ONCLUSION
In this paper, we systemically discussed the physical ad-
versarial attacks in computer vision tasks, including image
recognition and object detector tasks. We argue that DNN-
based systems still face enormous potential risks in both digital
and physical environments. These risks should be thoroughly
studied to avoid unnecessary loss when widely deployed in
the real world. Specifically, we proposed a taxonomy scheme
to categorize the current physical adversarial attack to provide
a comprehensive overview. By reviewing the existing physical
adversarial attack, we summarize the common characteristic of
physical adversarial attacks, which may be helpful to future
physical adversarial attack research. Finally, we discuss the
problems that need to be solved in physical adversarial attacks
and provide some possible research directions.
VIII. ACKNOWLEDGMENTS
This work was supported by the National Natural Science
Foundation of China (No.11725211 and 52005505).
.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
R EFERENCES
[1] K. Simonyan and A. Zisserman, “Very deep convolutional networks for
large-scale image recognition,” arXiv preprint arXiv:1409.1556, 2014.
[2] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image
recognition,” in Proceedings of the IEEE conference on computer vision
and pattern recognition, 2016, pp. 770–778.
[3] N. Carion, F. Massa, G. Synnaeve, N. Usunier, A. Kirillov, and
S. Zagoruyko, “End-to-end object detection with transformers,” in
European conference on computer vision. Springer, 2020, pp. 213–
229.
[4] Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo,
“Swin transformer: Hierarchical vision transformer using shifted win-
dows,” in Proceedings of the IEEE/CVF International Conference on
Computer Vision, 2021, pp. 10 012–10 022.
[5] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N.
Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,”
Advances in neural information processing systems, vol. 30, 2017.
[6] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training
of deep bidirectional transformers for language understanding,” arXiv
preprint arXiv:1810.04805, 2018.
[7] D. Amodei, S. Ananthanarayanan, R. Anubhai, J. Bai, E. Battenberg,
C. Case, J. Casper, B. Catanzaro, Q. Cheng, G. Chen et al., “Deep
speech 2: End-to-end speech recognition in english and mandarin,”
in International conference on machine learning. PMLR, 2016, pp.
173–182.
[8] A. Gulati, J. Qin, C.-C. Chiu, N. Parmar, Y. Zhang, J. Yu, W. Han,
S. Wang, Z. Zhang, Y. Wu et al., “Conformer: Convolution-augmented
transformer for speech recognition,” arXiv preprint arXiv:2005.08100,
2020.
[9] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J.
Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”
in 2nd International Conference on Learning Representations, ICLR
2014, Banff, AB, Canada, April 14-16, 2014, Conference Track
Proceedings, 2014. [Online]. Available: http://arxiv.org/abs/1312.6199
[10] I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing
adversarial examples,” in International Conference on Learning
Representations, 2015. [Online]. Available: http://arxiv.org/abs/1412.
6572
[11] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine
learning at scale,” arXiv preprint arXiv:1611.01236, 2016.
[12] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards
deep learning models resistant to adversarial attacks,” in 6th Interna-
tional Conference on Learning Representations, ICLR 2018, Vancouver,
BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings.
OpenReview.net, 2018.
[13] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting
adversarial attacks with momentum,” 2018 IEEE/CVF Conference on
Computer Vision and Pattern Recognition, pp. 9185–9193, 2018.
[14] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural
networks,” in 2017 ieee symposium on security and privacy (sp). IEEE,
2017, pp. 39–57.
[15] Z. Huang and T. Zhang, “Black-box adversarial attack with
transferable model-based embedding,” in International Conference
on Learning Representations, 2020. [Online]. Available: https:
//openreview.net/forum?id=SJxhNTNYwB
[16] C. Li, H. Wang, J. Zhang, W. Yao, and T. Jiang, “An approximated
gradient sign method using differential evolution for black-box adver-
sarial attack,” IEEE Transactions on Evolutionary Computation, pp.
1–1, 2022.
[17] L. Sun, M. Tan, and Z. Zhou, “A survey of practical adversarial example
attacks,” Cybersecurity, vol. 1, no. 1, pp. 1–9, 2018.
[18] R. R. Wiyatno, A. Xu, O. Dia, and A. de Berker, “Adversarial
examples in modern machine learning: A review,” arXiv preprint
arXiv:1911.05268, 2019.
[19] S. Qiu, Q. Liu, S. Zhou, and C. Wu, “Review of artificial intelligence
adversarial attack and defense technologies,” Applied Sciences, vol. 9,
no. 5, p. 909, 2019.
[20] X. Yuan, P. He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and
defenses for deep learning,” IEEE transactions on neural networks and
learning systems, vol. 30, no. 9, pp. 2805–2824, 2019.
[21] A. Serban, E. Poll, and J. Visser, “Adversarial examples on ob-
ject recognition: A comprehensive survey,” ACM Computing Surveys
(CSUR), vol. 53, no. 3, pp. 1–38, 2020.
[22] K. Ren, T. Zheng, Z. Qin, and X. Liu, “Adversarial attacks and defenses
in deep learning,” Engineering, vol. 6, no. 3, pp. 346–360, 2020.
23
[23] J. Zhang and C. Li, “Adversarial examples: Opportunities and chal-
lenges,” IEEE transactions on neural networks and learning systems,
vol. 31, no. 7, pp. 2578–2593, 2019.
[24] Y. Hu, W. Kuang, Z. Qin, K. Li, J. Zhang, Y. Gao, W. Li, and K. Li,
“Artificial intelligence security: threats and countermeasures,” ACM
Computing Surveys (CSUR), vol. 55, no. 1, pp. 1–36, 2021.
[25] A. Aldahdooh, W. Hamidouche, S. A. Fezza, and O. Déforges, “Adver-
sarial example detection for dnn models: A review and experimental
comparison,” Artificial Intelligence Review, pp. 1–60, 2022.
[26] G. R. Machado, E. Silva, and R. R. Goldschmidt, “Adversarial machine
learning in image classification: A survey toward the defender’s per-
spective,” ACM Computing Surveys (CSUR), vol. 55, no. 1, pp. 1–38,
2021.
[27] A. Sharma, Y. Bian, P. Munz, and A. Narayan, “Adversarial patch
attacks and defences in vision-based tasks: A survey,” arXiv preprint
arXiv:2206.08304, 2022.
[28] H. Ren, T. Huang, and H. Yan, “Adversarial examples: attacks and
defenses in the physical world,” International Journal of Machine
Learning and Cybernetics, vol. 12, no. 11, pp. 3325–3336, 2021.
[29] J. Wang, A. Liu, X. Bai, and X. Liu, “Universal adversarial patch
attack for automatic checkout using perceptual and attentional bias,”
IEEE Transactions on Image Processing, vol. 31, pp. 598–611, 2021.
[30] J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention
suppression attack: Generate adversarial camouflage in physical world,”
in Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition, 2021, pp. 8565–8574.
[31] X. Zhu, X. Li, J. Li, Z. Wang, and X. Hu, “Fooling thermal infrared
pedestrian detectors in real world using small bulbs,” in Proceedings
of the AAAI Conference on Artificial Intelligence, vol. 35, no. 4, 2021,
pp. 3616–3624.
[32] X. Zhu, Z. Hu, S. Huang, J. Li, and X. Hu, “Infrared invisible clothing:
Hiding from infrared detectors at multiple angles in real world,” in
Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition, 2022, pp. 13 317–13 326.
[33] D. Wang, T. Jiang, J. Sun, W. Zhou, Z. Gong, X. Zhang, W. Yao, and
X. Chen, “Fca: Learning a 3d full-coverage vehicle camouflage for
multi-view physical adversarial attack,” in Proceedings of the AAAI
Conference on Artificial Intelligence, vol. 36, no. 2, 2022, pp. 2414–
2422.
[34] Y. Duan, J. Chen, X. Zhou, J. Zou, Z. He, J. Zhang, W. Zhang, and
Z. Pan, “Learning coated adversarial camouflages for object detectors,”
in Proceedings of the Thirty-First International Joint Conference on
Artificial Intelligence, IJCAI 2022, Vienna, Austria, 23-29 July 2022,
L. D. Raedt, Ed., 2022, pp. 891–897.
[35] N. Suryanto, Y. Kim, H. Kang, H. T. Larasati, Y. Yun, T.-T.-H. Le,
H. Yang, S.-Y. Oh, and H. Kim, “Dta: Physical camouflage attacks
using differentiable transformation network,” in Proceedings of the
IEEE/CVF Conference on Computer Vision and Pattern Recognition,
2022, pp. 15 305–15 314.
[36] S. Pavlitskaya, B.-M. Codău, and J. M. Zöllner, “Feasibility of incon-
spicuous gan-generated adversarial patches against object detection,”
arXiv preprint arXiv:2207.07347, 2022.
[37] Y. Nemcovsky, M. Yaakoby, A. M. Bronstein, and C. Baskin, “Physical
passive patch adversarial attacks on visual odometry systems,” arXiv
preprint arXiv:2207.05729, 2022.
[38] B. G. Doan, M. Xue, S. Ma, E. Abbasnejad, and D. C. Ranasinghe, “Tnt
attacks! universal naturalistic adversarial patches against deep neural
network systems,” IEEE Transactions on Information Forensics and
Security, 2022.
[39] X. Wei, Y. Guo, and J. Yu, “Adversarial sticker: A stealthy attack
method in the physical world,” IEEE Transactions on Pattern Analysis
and Machine Intelligence, 2022.
[40] X. Wei, B. Pu, J. Lu, and B. Wu, “Physically adversarial attacks and de-
fenses in computer vision: A survey,” arXiv preprint arXiv:2211.01671,
2022.
[41] H. Wei, H. Tang, X. Jia, H. Yu, Z. Li, Z. Wang, S. Satoh, and Z. Wang,
“Physical adversarial attack meets computer vision: A decade survey,”
arXiv preprint arXiv:2209.15179, 2022.
[42] K. Simonyan and A. Zisserman, “Very deep convolutional networks for
large-scale image recognition,” arXiv preprint arXiv:1409.1556, 2014.
[43] G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger,
“Densely connected convolutional networks,” in Proceedings of the
IEEE conference on computer vision and pattern recognition, 2017,
pp. 4700–4708.
[44] J. Redmon, S. Divvala, R. Girshick, and A. Farhadi, “You only look
once: Unified, real-time object detection,” in Proceedings of the IEEE
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
conference on computer vision and pattern recognition, 2016, pp. 779–
788.
[45] S.-T. Chen, C. Cornelius, J. Martin, and D. H. P. Chau, “Shapeshifter:
Robust physical adversarial attack on faster r-cnn object detector,”
in Joint European Conference on Machine Learning and Knowledge
Discovery in Databases. Springer, 2018, pp. 52–68.
[46] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao,
A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks
on deep learning visual classification,” in Proceedings of the IEEE
conference on computer vision and pattern recognition, 2018, pp.
1625–1634.
[47] S. Thys, W. Van Ranst, and T. Goedemé, “Fooling automated surveil-
lance cameras: adversarial patches to attack person detection,” in
Proceedings of the IEEE/CVF conference on computer vision and
pattern recognition workshops, 2019, pp. 0–0.
[48] L. Huang, C. Gao, Y. Zhou, C. Xie, A. L. Yuille, C. Zou, and
N. Liu, “Universal physical camouflage attacks on object detectors,”
in Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition, 2020, pp. 720–729.
[49] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, “Synthesizing
robust adversarial examples,” in International conference on machine
learning. PMLR, 2018, pp. 284–293.
[50] D. Song, K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati,
F. Tramer, A. Prakash, and T. Kohno, “Physical adversarial examples
for object detectors,” in 12th USENIX workshop on offensive technolo-
gies (WOOT 18), 2018.
[51] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to
a crime: Real and stealthy attacks on state-of-the-art face recognition,”
in Proceedings of the 2016 acm sigsac conference on computer and
communications security, 2016, pp. 1528–1540.
[52] A. Mahendran and A. Vedaldi, “Understanding deep image represen-
tations by inverting them,” in Proceedings of the IEEE conference on
computer vision and pattern recognition, 2015, pp. 5188–5196.
[53] S. T. Jan, J. Messou, Y.-C. Lin, J.-B. Huang, and G. Wang, “Connecting
the digital and physical world: Improving the robustness of adversarial
attacks,” in Proceedings of the AAAI Conference on Artificial Intelli-
gence, vol. 33, no. 01, 2019, pp. 962–969.
[54] A. Liu, J. Wang, X. Liu, B. Cao, C. Zhang, and H. Yu, “Bias-
based universal adversarial patch attack for automatic check-out,” in
European conference on computer vision. Springer, 2020, pp. 395–
410.
[55] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples
in the physical world,” in 5th International Conference on Learning
Representations. OpenReview.net, 2017, pp. 24–26.
[56] Q. Guo, F. Juefei-Xu, X. Xie, L. Ma, J. Wang, B. Yu, W. Feng, and
Y. Liu, “Watch out! motion is blluurrrri inngg the vision of your deep
neural networks,” in Proceedings of the 34th International Conference
on Neural Information Processing Systems, 2020, pp. 975–985.
[57] W. Feng, B. Wu, T. Zhang, Y. Zhang, and Y. Zhang, “Meta-attack:
Class-agnostic and model-agnostic physical adversarial attack,” in
Proceedings of the IEEE/CVF International Conference on Computer
Vision, 2021, pp. 7787–7796.
[58] B. Phan, F. Mannan, and F. Heide, “Adversarial imaging pipelines,”
in Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition, 2021, pp. 16 051–16 061.
[59] T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial
patch,” Advances in Neural Information Processing Systems, 2017.
[60] S. Casper, M. Nadeau, D. Hadfield-Menell, and G. Kreiman, “Robust
feature-level adversaries are interpretability tools,” in Advances in
Neural Information Processing Systems, 2022.
[61] Y. Dong, S. Ruan, H. Su, C. Kang, X. Wei, and J. Zhu, “Viewfool:
Evaluating the robustness of visual recognition to adversarial view-
points,” in Advances in Neural Information Processing Systems, A. H.
Oh, A. Agarwal, D. Belgrave, and K. Cho, Eds., 2022.
[62] N. Nichols and R. Jasper, “Projecting trouble: Light based adversarial
attacks on deep learning classifiers,” Proceedings of the AAAI Fall
Symposium on Adversary-Aware Learning Techniques and Trends in
Cybersecurity, 2018.
[63] Y. Man, M. Li, and R. Gerdes, “Poster: Perceived adversarial exam-
ples,” in IEEE Symposium on Security and Privacy, no. 2019, 2019.
[64] A. Gnanasambandam, A. M. Sherman, and S. H. Chan, “Optical
adversarial attack,” in Proceedings of the IEEE/CVF International
Conference on Computer Vision, 2021, pp. 92–101.
[65] A. Sayles, A. Hooda, M. Gupta, R. Chatterjee, and E. Fernandes,
“Invisible perturbations: Physical adversarial examples exploiting the
rolling shutter effect,” in Proceedings of the IEEE/CVF Conference on
Computer Vision and Pattern Recognition, 2021, pp. 14 666–14 675.
24
[66] R. Duan, X. Mao, A. K. Qin, Y. Chen, S. Ye, Y. He, and Y. Yang,
“Adversarial laser beam: Effective physical-world attack to dnns in
a blink,” in Proceedings of the IEEE/CVF Conference on Computer
Vision and Pattern Recognition, 2021, pp. 16 062–16 071.
[67] K. Kim, J. Kim, S. Song, J.-H. Choi, C. Joo, and J.-S. Lee, “Light lies:
Optical adversarial attack,” arXiv preprint arXiv:2106.09908, 2021.
[68] B. Huang and H. Ling, “Spaa: Stealthy projector-based adversarial
attacks on deep image classifiers,” in 2022 IEEE Conference on Virtual
Reality and 3D User Interfaces (VR). IEEE, 2022, pp. 534–542.
[69] M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “A general
framework for adversarial examples with objectives,” ACM Transac-
tions on Privacy and Security (TOPS), vol. 22, no. 3, pp. 1–30, 2019.
[70] I. Singh, S. Momiyama, K. Kakizaki, and T. Araki, “On brightness
agnostic adversarial examples against face recognition systems,” in
2021 International Conference of the Biometrics Special Interest Group
(BIOSIG). IEEE, 2021, pp. 1–5.
[71] B. Zhang, B. Tondi, and M. Barni, “Adversarial examples for replay
attacks against cnn-based face recognition with anti-spoofing capabil-
ity,” Computer Vision and Image Understanding, vol. 197, p. 102988,
2020.
[72] M. Pautov, G. Melnikov, E. Kaziakhmedov, K. Kireev, and
A. Petiushko, “On adversarial patches: real-world attack on arcface-100
face recognition system,” in 2019 International Multi-Conference on
Engineering, Computer and Information Sciences (SIBIRCON). IEEE,
2019, pp. 0391–0396.
[73] S. Komkov and A. Petiushko, “Advhat: Real-world adversarial attack
on arcface face id system,” in 2020 25th International Conference on
Pattern Recognition (ICPR). IEEE, 2021, pp. 819–826.
[74] Z. Xiao, X. Gao, C. Fu, Y. Dong, W. Gao, X. Zhang, J. Zhou,
and J. Zhu, “Improving transferability of adversarial patches on face
recognition with generative models,” in Proceedings of the IEEE/CVF
Conference on Computer Vision and Pattern Recognition, 2021, pp.
11 845–11 854.
[75] X. Wei, Y. Guo, J. Yu, and B. Zhang, “Simultaneously optimizing
perturbations and positions for black-box adversarial patch attacks,”
arXiv preprint arXiv:2212.12995, 2022.
[76] A. Zolfi, S. Avidan, Y. Elovici, and A. Shabtai, “Adversarial mask:
Real-world adversarial attack against face recognition models,” 2022.
[77] D.-L. Nguyen, S. S. Arora, Y. Wu, and H. Yang, “Adversarial light
projection attacks on face recognition systems: A feasibility study,”
in Proceedings of the IEEE/CVF conference on computer vision and
pattern recognition workshops, 2020, pp. 814–815.
[78] C. Sitawarin, A. N. Bhagoji, A. Mosenia, P. Mittal, and M. Chiang,
“Rogue signs: Deceiving traffic sign recognition with malicious ads
and logos,” arXiv preprint arXiv:1801.02780, 2018.
[79] A. Liu, X. Liu, J. Fan, Y. Ma, A. Zhang, H. Xie, and D. Tao,
“Perceptual-sensitive gan for generating adversarial patches,” in Pro-
ceedings of the AAAI conference on artificial intelligence, vol. 33,
no. 01, 2019, pp. 1028–1035.
[80] R. Duan, X. Ma, Y. Wang, J. Bailey, A. K. Qin, and Y. Yang,
“Adversarial camouflage: Hiding physical-world attacks with natural
styles,” in Proceedings of the IEEE/CVF conference on computer vision
and pattern recognition, 2020, pp. 1000–1008.
[81] Y. Zhong, X. Liu, D. Zhai, J. Jiang, and X. Ji, “Shadows can be
dangerous: Stealthy and effective physical-world adversarial attack by
natural phenomenon,” in Proceedings of the IEEE/CVF Conference on
Computer Vision and Pattern Recognition, 2022, pp. 15 345–15 354.
[82] Z. Wang, S. Zheng, M. Song, Q. Wang, A. Rahimpour, and H. Qi,
“advpattern: physical-world attacks on deep person re-identification via
adversarially transformable patterns,” in Proceedings of the IEEE/CVF
International Conference on Computer Vision, 2019, pp. 8341–8350.
[83] Z. Kong, J. Guo, A. Li, and C. Liu, “Physgan: Generating physical-
world-resilient adversarial examples for autonomous driving,” in Pro-
ceedings of the IEEE/CVF Conference on Computer Vision and Pattern
Recognition, 2020, pp. 14 254–14 263.
[84] Y. Qian, D. Ma, B. Wang, J. Pan, J. Wang, Z. Gu, J. Chen, W. Zhou,
and J. Lei, “Spot evasion attacks: Adversarial examples for license plate
recognition systems with convolutional neural networks,” Computers &
Security, vol. 95, p. 101826, 2020.
[85] Y. Zhao, H. Zhu, R. Liang, Q. Shen, S. Zhang, and K. Chen, “Seeing
isn’t believing: Towards more robust adversarial attack against real
world object detectors,” in Proceedings of the 2019 ACM SIGSAC
Conference on Computer and Communications Security, 2019, pp.
1989–2004.
[86] M. Lee and Z. Kolter, “On physical adversarial patches for object
detection,” arXiv preprint arXiv:1906.11897, 2019.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022
[87] K. Yang, T. Tsai, H. Yu, T.-Y. Ho, and Y. Jin, “Beyond digital domain:
Fooling deep learning based recognition system in physical world,” in
Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34,
no. 01, 2020, pp. 1088–1095.
[88] A. Zolfi, M. Kravchik, Y. Elovici, and A. Shabtai, “The translucent
patch: A physical and universal attack on object detectors,” in Pro-
ceedings of the IEEE/CVF Conference on Computer Vision and Pattern
Recognition, 2021, pp. 15 232–15 241.
[89] A. Shapira, R. Bitton, D. Avraham, A. Zolfi, Y. Elovici, and A. Shabtai,
“Attacking object detector using a universal targeted label-switch
patch,” arXiv preprint arXiv:2211.08859, 2022.
[90] S. Hoory, T. Shapira, A. Shabtai, and Y. Elovici, “Dynamic ad-
versarial patch for evading object detection models,” arXiv preprint
arXiv:2010.13070, 2020.
[91] D. Y. Yang, J. Xiong, X. Li, X. Yan, J. Raiti, Y. Wang, H. Wu,
and Z. Zhong, “Building towards” invisible cloak”: Robust physical
adversarial attack on yolo object detector,” in 2018 9th IEEE Annual
Ubiquitous Computing, Electronics & Mobile Communication Confer-
ence (UEMCON). IEEE, 2018, pp. 368–374.
[92] K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y. Chen,
Y. Wang, and X. Lin, “Adversarial t-shirt! evading person detectors in a
physical world,” in European conference on computer vision. Springer,
2020, pp. 665–681.
[93] Z. Wu, S.-N. Lim, L. S. Davis, and T. Goldstein, “Making an invisibility
cloak: Real world adversarial attacks on object detectors,” in European
Conference on Computer Vision. Springer, 2020, pp. 1–17.
[94] J. Tan, N. Ji, H. Xie, and X. Xiang, “Legitimate adversarial patches:
Evading human eyes and detection models in the physical world,” in
Proceedings of the 29th ACM International Conference on Multimedia,
2021, pp. 5307–5315.
[95] Y.-C.-T. Hu, B.-H. Kung, D. S. Tan, J.-C. Chen, K.-L. Hua, and W.-H.
Cheng, “Naturalistic physical adversarial patch for object detectors,” in
Proceedings of the IEEE/CVF International Conference on Computer
Vision, 2021, pp. 7848–7857.
[96] Z. Hu, S. Huang, X. Zhu, F. Sun, B. Zhang, and X. Hu, “Adversarial
texture for fooling person detectors in the physical world,” in Proceed-
ings of the IEEE/CVF Conference on Computer Vision and Pattern
Recognition, 2022, pp. 13 307–13 316.
[97] G. Lovisotto, H. Turner, I. Sluganovic, M. Strohmeier, and I. Mar-
tinovic, “Slap: Improving physical adversarial examples with short-
lived adversarial perturbations,” in 30th USENIX Security Symposium
(USENIX Security 21), 2021, pp. 1865–1882.
[98] X. Zeng, C. Liu, Y.-S. Wang, W. Qiu, L. Xie, Y.-W. Tai, C.-K. Tang,
and A. L. Yuille, “Adversarial attacks beyond the image space,” in
Proceedings of the IEEE/CVF Conference on Computer Vision and
Pattern Recognition, 2019, pp. 4302–4311.
[99] Y. Zhang, P. H. Foroosh, and B. Gong, “Camou: Learning a vehicle
camouflage for physical adversarial attack on object detections in the
wild,” ICLR, 2019.
[100] T. Wu, X. Ning, W. Li, R. Huang, H. Yang, and Y. Wang, “Physical
adversarial attack on vehicle detector in the carla simulator,” arXiv
preprint arXiv:2007.16118, 2020.
[101] A. Du, B. Chen, T.-J. Chin, Y. W. Law, M. Sasdelli, R. Rajasegaran,
and D. Campbell, “Physical adversarial attacks on an aerial imagery
object detector,” in Proceedings of the IEEE/CVF Winter Conference
on Applications of Computer Vision, 2022, pp. 1796–1806.
[102] F. Nesti, G. Rossolini, S. Nair, A. Biondi, and G. Buttazzo, “Evalu-
ating the robustness of semantic segmentation for autonomous driving
against real-world adversarial patch attacks,” in Proceedings of the
IEEE/CVF Winter Conference on Applications of Computer Vision,
2022, pp. 2280–2289.
[103] Z. Cheng, J. Liang, H. Choi, G. Tao, Z. Cao, D. Liu, and X. Zhang,
“Physical attack on monocular depth estimation with optimal adversar-
ial patches,” in European Conference on Computer Vision. Springer,
2022, pp. 514–532.
[104] R. R. Wiyatno and A. Xu, “Physical adversarial textures that fool
visual object tracking,” in Proceedings of the IEEE/CVF International
Conference on Computer Vision, 2019, pp. 4822–4831.
[105] L. Ding, Y. Wang, K. Yuan, M. Jiang, P. Wang, H. Huang, and Z. J.
Wang, “Towards universal physical attacks on single object tracking,”
in AAAI, 2021, pp. 1236–1245.
[106] P. Isola, J.-Y. Zhu, T. Zhou, and A. A. Efros, “Image-to-image
translation with conditional adversarial networks,” in Proceedings of
the IEEE conference on computer vision and pattern recognition, 2017,
pp. 1125–1134.
[107] J.-Y. Zhu, T. Park, P. Isola, and A. A. Efros, “Unpaired image-to-image
translation using cycle-consistent adversarial networks,” in Proceedings
25
of the IEEE international conference on computer vision, 2017, pp.
2223–2232.
[108] M. Jaderberg, K. Simonyan, A. Zisserman et al., “Spatial transformer
networks,” Advances in neural information processing systems, vol. 28,
2015.
[109] C. Xiao, B. Li, J.-Y. Zhu, W. He, M. Liu, and D. Song, “Generating
adversarial examples with adversarial networks,” in Proceedings of the
27th International Joint Conference on Artificial Intelligence, 2018, p.
3905–3911.
[110] Z.-A. Zhu, Y.-Z. Lu, and C.-K. Chiang, “Generating adversarial
examples by makeup attacks on face recognition,” in 2019 IEEE
International Conference on Image Processing (ICIP). IEEE, 2019,
pp. 2516–2520.
[111] T. Malzbender, D. Gelb, and H. Wolters, “Polynomial texture maps,”
in Proceedings of the 28th annual conference on Computer graphics
and interactive techniques, 2001, pp. 519–528.
[112] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and
D. Batra, “Grad-cam: Visual explanations from deep networks via
gradient-based localization,” in Proceedings of the IEEE international
conference on computer vision, 2017, pp. 618–626.
[113] L. A. Gatys, A. S. Ecker, and M. Bethge, “Image style transfer using
convolutional neural networks,” in Proceedings of the IEEE conference
on computer vision and pattern recognition, 2016, pp. 2414–2423.
[114] J. Redmon and A. Farhadi, “Yolov3: An incremental improvement,”
arXiv preprint arXiv:1804.02767, 2018.
[115] W. Liu, D. Anguelov, D. Erhan, C. Szegedy, S. Reed, C.-Y. Fu,
and A. C. Berg, “Ssd: Single shot multibox detector,” in European
conference on computer vision. Springer, 2016, pp. 21–37.
[116] T.-Y. Lin, P. Goyal, R. Girshick, K. He, and P. Dollár, “Focal loss
for dense object detection,” in Proceedings of the IEEE international
conference on computer vision, 2017, pp. 2980–2988.
[117] S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time
object detection with region proposal networks,” Advances in neural
information processing systems, vol. 28, pp. 91–99, 2015.
[118] K. He, G. Gkioxari, P. Dollár, and R. Girshick, “Mask r-cnn,” in
Proceedings of the IEEE international conference on computer vision,
2017, pp. 2961–2969.
[119] X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y. Chen, “Dpatch:
An adversarial patch attack on object detectors,” arXiv preprint
arXiv:1806.02299, 2018.
[120] T.-Y. Lin, P. Dollár, R. Girshick, K. He, B. Hariharan, and S. Belongie,
“Feature pyramid networks for object detection,” in Proceedings of the
IEEE conference on computer vision and pattern recognition, 2017,
pp. 2117–2125.
[121] X. Yang, F. Wei, H. Zhang, and J. Zhu, “Design and interpretation of
universal adversarial patches in face detection,” in European Confer-
ence on Computer Vision. Springer, 2020, pp. 174–191.
[122] C. Xiao, D. Yang, B. Li, J. Deng, and M. Liu, “Meshadv: Adversarial
meshes for visual recognition,” in Proceedings of the IEEE/CVF
Conference on Computer Vision and Pattern Recognition, 2019, pp.
6898–6907.
[123] A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V. Koltun, “Carla:
An open urban driving simulator,” in Conference on robot learning.
PMLR, 2017, pp. 1–16.
[124] Z. Li, C. Peng, G. Yu, X. Zhang, Y. Deng, and J. Sun, “Light-
head r-cnn: In defense of two-stage object detector,” arXiv preprint
arXiv:1711.07264, 2017.
[125] H. Kato, Y. Ushiku, and T. Harada, “Neural 3d mesh renderer,” in
Proceedings of the IEEE conference on computer vision and pattern
recognition, 2018, pp. 3907–3916.
[126] M. Tan, R. Pang, and Q. V. Le, “Efficientdet: Scalable and efficient
object detection,” in Proceedings of the IEEE/CVF conference on
computer vision and pattern recognition, 2020, pp. 10 781–10 790.
[127] J. Byun, S. Cho, M.-J. Kwon, H.-S. Kim, and C. Kim, “Improving
the transferability of targeted adversarial examples through object-
based diverse input,” in Proceedings of the IEEE/CVF Conference on
Computer Vision and Pattern Recognition, 2022, pp. 15 244–15 253.
[128] M. A. Alcorn, Q. Li, Z. Gong, C. Wang, L. Mai, W.-S. Ku, and
A. Nguyen, “Strike (with) a pose: Neural networks are easily fooled
by strange poses of familiar objects,” in Proceedings of the IEEE/CVF
Conference on Computer Vision and Pattern Recognition, 2019, pp.
4845–4854.
[129] R. den Hollander, A. Adhikari, I. Tolios, M. van Bekkum, A. Bal,
S. Hendriks, M. Kruithof, D. Gross, N. Jansen, G. Perez et al.,
“Adversarial patch camouflage against aerial detection,” in Artificial
Intelligence and Machine Learning in Defense Applications II, vol.
11543. SPIE, 2020, pp. 77–86.
JOURNAL OF LATEX CLASS FILES, VOL. 18, NO. 9, SEPTEMBER 2022 26

[130] L. Chen, G. Zhu, Q. Li, and H. Li, “Adversarial example in remote tion,” in Proceedings of the IEEE international conference on computer
sensing image recognition,” arXiv preprint arXiv:1910.13222, 2019. vision, 2017, pp. 2755–2764.
[131] L. Chen, H. Li, G. Zhu, Q. Li, J. Zhu, H. Huang, J. Peng, and L. Zhao, [153] K. K. Nakka and M. Salzmann, “Indirect local attacks for context-
“Attack selectivity of adversarial examples in remote sensing image aware semantic segmentation networks,” in European Conference on
scene classification,” IEEE Access, vol. 8, pp. 137 477–137 489, 2020. Computer Vision. Springer, 2020, pp. 611–628.
[132] Y. Xu, B. Du, and L. Zhang, “Assessing the threat of adversarial exam- [154] A. Arnab, O. Miksik, and P. H. Torr, “On the robustness of semantic
ples on deep neural networks for remote sensing scene classification: segmentation models to adversarial attacks,” in Proceedings of the
Attacks and defenses,” IEEE Transactions on Geoscience and Remote IEEE Conference on Computer Vision and Pattern Recognition, 2018,
Sensing, vol. 59, no. 2, pp. 1604–1617, 2020. pp. 888–897.
[133] Y. Wang, K. Wang, Z. Zhu, and F.-Y. Wang, “Adversarial attacks on [155] M. Alzantot, Y. Sharma, S. Chakraborty, H. Zhang, C.-J. Hsieh, and
faster r-cnn object detector,” Neurocomputing, vol. 382, pp. 87–95, M. B. Srivastava, “Genattack: Practical black-box attacks with gradient-
2020. free optimization,” in Proceedings of the Genetic and Evolutionary
[134] K.-H. Chow, L. Liu, M. Loper, J. Bae, M. E. Gursoy, S. Truex, W. Wei, Computation Conference, 2019, pp. 1111–1119.
and Y. Wu, “Adversarial objectness gradient attacks in real-time object [156] M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square
detection systems,” in 2020 Second IEEE International Conference on attack: a query-efficient black-box adversarial attack via random
Trust, Privacy and Security in Intelligent Systems and Applications search,” in European Conference on Computer Vision. Springer, 2020,
(TPS-ISA). IEEE, 2020, pp. 263–272. pp. 484–501.
[135] D. Wang, C. Li, S. Wen, Q.-L. Han, S. Nepal, X. Zhang, and Y. Xiang, [157] C. Li, W. Yao, H. Wang, and T. Jiang, “Adaptive momentum variance
“Daedalus: Breaking nonmaximum suppression in object detection via for attention-guided sparse adversarial attacks,” Pattern Recognition,
adversarial examples,” IEEE Transactions on Cybernetics, 2021. vol. 133, p. 108979, 2023.
[136] Q. Liao, X. Wang, B. Kong, S. Lyu, Y. Yin, Q. Song, and X. Wu, [158] A. Ghosh, S. S. Mullick, S. Datta, S. Das, A. K. Das, and R. Mallipeddi,
“Fast local attack: Generating local adversarial examples for object “A black-box adversarial attack strategy with adjustable sparsity and
detectors,” in 2020 International Joint Conference on Neural Networks generalizability for deep image classifiers,” Pattern Recognition, vol.
(IJCNN). IEEE, 2020, pp. 1–8. 122, p. 108279, 2022.
[137] J. Bao, “Sparse adversarial attack to object detection,” arXiv preprint [159] A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V. Koltun,
arXiv:2012.13692, 2020. “CARLA: An open urban driving simulator,” in Proceedings of the
[138] S. Wu, T. Dai, and S.-T. Xia, “Dpattack: Diffused patch attacks against 1st Annual Conference on Robot Learning, 2017, pp. 1–16.
universal object detection,” arXiv preprint arXiv:2010.11679, 2020. [160] S. Shah, D. Dey, C. Lovett, and A. Kapoor, “Airsim: High-
[139] H. Huang, Y. Wang, Z. Chen, Z. Tang, W. Zhang, and K.-K. Ma, fidelity visual and physical simulation for autonomous vehicles,”
“Rpattack: Refined patch attack on general object detectors,” in 2021 in Field and Service Robotics, 2017. [Online]. Available: https:
IEEE International Conference on Multimedia and Expo (ICME). //arxiv.org/abs/1705.05065
IEEE, 2021, pp. 1–6. [161] H. Salman, A. Ilyas, L. Engstrom, S. Vemprala, A. Madry, and
A. Kapoor, “Unadversarial examples: Designing objects for robust
[140] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and
vision,” Advances in Neural Information Processing Systems, vol. 34,
A. Swami, “The limitations of deep learning in adversarial settings,” in
pp. 15 270–15 284, 2021.
2016 IEEE European symposium on security and privacy (EuroS&P).
[162] J. Wang, Z. Yin, P. Hu, A. Liu, R. Tao, H. Qin, X. Liu, and D. Tao,
IEEE, 2016, pp. 372–387.
“Defensive patches for robust recognition in the physical world,” in
[141] F. Croce and M. Hein, “Sparse and imperceivable adversarial attacks,”
Proceedings of the IEEE/CVF Conference on Computer Vision and
in Proceedings of the IEEE/CVF International Conference on Com-
Pattern Recognition, 2022, pp. 2456–2465.
puter Vision, 2019, pp. 4724–4732.
[142] A. Modas, S.-M. Moosavi-Dezfooli, and P. Frossard, “Sparsefool: a
few pixels make a big difference,” in Proceedings of the IEEE/CVF
conference on computer vision and pattern recognition, 2019, pp.
9087–9096.
[143] X. Dong, D. Chen, J. Bao, C. Qin, L. Yuan, W. Zhang, N. Yu,
and D. Chen, “Greedyfool: Distortion-aware sparse adversarial attack,”
Advances in Neural Information Processing Systems, vol. 33, pp.
11 226–11 236, 2020.
[144] Z. He, W. Wang, J. Dong, and T. Tan, “Transferable sparse adversarial
attack,” in Proceedings of the IEEE/CVF Conference on Computer
Vision and Pattern Recognition, 2022, pp. 14 963–14 972.
[145] Y. Zhao, H. Yan, and X. Wei, “Object hider: Adversarial patch attack
against object detectors,” arXiv preprint arXiv:2010.14974, 2020.
[146] D. Li, J. Zhang, and K. Huang, “Universal adversarial perturbations
against object detection,” Pattern Recognition, vol. 110, p. 107584,
2021.
[147] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Univer-
sal adversarial perturbations,” in Proceedings of the IEEE conference
on computer vision and pattern recognition, 2017, pp. 1765–1773.
[148] Z. Zhu, H. Su, C. Liu, W. Xiang, and S. Zheng, “You cannot easily
catch me: A low-detectable adversarial patch for object detectors,”
arXiv preprint arXiv:2109.15177, 2021.
[149] Y. Cao, C. Xiao, B. Cyr, Y. Zhou, W. Park, S. Rampazzi, Q. A.
Chen, K. Fu, and Z. M. Mao, “Adversarial sensor attack on lidar-based
perception in autonomous driving,” in Proceedings of the 2019 ACM
SIGSAC conference on computer and communications security, 2019,
pp. 2267–2281.
[150] T. Sato, J. Shen, N. Wang, Y. Jia, X. Lin, and Q. A. Chen, “Dirty road
can attack: Security of deep learning based automated lane centering
under {Physical-World} attack,” in 30th USENIX Security Symposium
(USENIX Security 21), 2021, pp. 3309–3326.
[151] J. Tu, H. Li, X. Yan, M. Ren, Y. Chen, M. Liang, E. Bitar, E. Yumer,
and R. Urtasun, “Exploring adversarial robustness of multi-sensor
perception systems in self driving,” arXiv preprint arXiv:2101.06784,
2021.
[152] J. Hendrik Metzen, M. Chaithanya Kumar, T. Brox, and V. Fischer,
“Universal adversarial perturbations against semantic image segmenta-